DEBIAN-CVE-2026-112320: High severity debian/krb5 vulnerability
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSECGSS or AUTHGSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
Affected Software
Event History
Frequently Asked Questions
Which services are exposed to this denial of service?
The issue can exhaust memory in kadmind through the GSS-RPC transport layer. Systems running kadmind that accept affected RPC connections are the relevant exposure point.
What does an attacker need to do to trigger the issue?
A remote attacker can repeatedly establish GSS authentication contexts and then switch from RPCSEC_GSS or AUTH_GSSAPI to a non-GSS authentication flavor on the same TCP connection. No privileges or user interaction are required according to the supplied severity vector.
Are only recent Kerberos releases affected?
The issue is described as affecting MIT Kerberos 5 version 1.4 and later. The provided data does not identify specific fixed Debian package versions.