RHSA-2026:99624: Important: krb5 security, bug fix, and enhancement update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).Security Fix(es): krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTHGSSAPIINIT requests (CVE-2026-112323) krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTHGSSAPI client states cleanup (CVE-2026-112322) krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314) krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200) krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTHGSSAPIINIT error paths (CVE-2026-112321) krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320) krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884) krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319) krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318) krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317) krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079) krb5: MIT krb5 kadmind authenticated memory leak DoS in xdrkrb5tldata() decode failure (CVE-2026-112316) krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423) krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSECGSS buffer decode failure (CVE-2026-112315) krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708) krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778) krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199) krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380) krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364) Bug Fix(es) and Enhancement(s): Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:RHEL-278063) authgssapiwrapdata xdrbytes failure leak [rhel-10.3.z] (JIRA:RHEL-296012) xdrbytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:RHEL-296023) RPCSECGSS context lifecycle leaks [rhel-10.3.z] (JIRA:RHEL-296034) xdrkrb5principal decode leak [rhel-10.3.z] (JIRA:RHEL-296045) processchpwrequest leak [rhel-10.3.z] (JIRA:RHEL-296056) Read overruns in GSSRPC svcauthunix [rhel-10.3.z] (JIRA:RHEL-296067) Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:RHEL-296081) KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:RHEL-296095) Memory leak on krb5 gssacceptseccontext() failure [rhel-10.3.z] (JIRA:RHEL-296112) KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-10.3.z] (JIRA:RHEL-296127) Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:RHEL-296997) Null dereference of principal names in krb5rdcred() [rhel-10.3.z] (JIRA:RHEL-297000) Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:RHEL-299144) Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:RHEL-299145) Pass through null delegcred from SPNEGO to mech [rhel-10.3.z] (JIRA:RHEL-299146) Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:RHEL-299147) Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:RHEL-299148) Check reply length before V4 reply check [rhel-10.3.z] (JIRA:RHEL-299149) Fix memory leak in mpoolget() error paths [rhel-10.3.z] (JIRA:RHEL-299150) json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:RHEL-299151) Prevent unsigned int overflow in iakerbsavetoken() [rhel-10.3.z] (JIRA:RHEL-299152) Fix ksu memory leak in fcmdresolve() [rhel-10.3.z] (JIRA:RHEL-299153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat