DEBIAN-CVE-2026-112317: Medium severity debian/krb5 vulnerability
Published Nov 9, 2026
·Updated
krb5ktkdbgetentry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
Affected Software
3 affected components
debian/krb5*
debian/krb5*
debian/krb5*
Event History
Nov 9, 2026
CVE Published
via OSV·07:16 PM
Data Sourced
via OSV·07:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which services are exposed to this denial of service?
The memory leak can affect the KDC or kadmind when they process requests that repeatedly trigger key decryption failures.
2
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
3
What condition must an attacker trigger?
Requests must repeatedly cause key decryption to fail after decryption, so that the post-decryption check fails and decrypted key material is not freed.