DEBIAN-CVE-2026-112316: Medium severity debian/krb5 vulnerability
Published Nov 9, 2026
·Updated
xdrkrb5tldata() in lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
Affected Software
3 affected components
debian/krb5*
debian/krb5*
debian/krb5*
Event History
Nov 9, 2026
CVE Published
via OSV·07:16 PM
Data Sourced
via OSV·07:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are exposed?
Systems running the kadmind service are exposed if remote authenticated users can send RPC requests to it. The affected software is Debian's krb5 package.
2
What access does an attacker need?
An attacker needs valid authentication and the ability to send crafted RPC requests to kadmind that cause a decoding failure. No user interaction is required.