DEBIAN-CVE-2026-112319: Medium severity debian/krb5 vulnerability
Published Nov 9, 2026
·Updated
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
Affected Software
3 affected components
debian/krb5*
debian/krb5*
debian/krb5*
Event History
Nov 9, 2026
CVE Published
via OSV·07:16 PM
Data Sourced
via OSV·07:16 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be remotely authenticated and able to send crafted RPC requests to kadmind. No user interaction is required, and the attack complexity is rated low.
2
Which security property is affected?
The reported impact is limited to availability: kadmind may exhaust memory or consume excessive CPU. The provided vector indicates no confidentiality or integrity impact.