UBUNTU-CVE-2026-112315: Medium severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

The RPCSECGSS authentication routines in lib/rpc/authgssprot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSECGSS messages.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require valid credentials or user interaction?

No. The vulnerability is rated as requiring no privileges and no user interaction, and it is reachable over the network.

What is the primary security impact to prioritize?

The stated impact is availability: crafted RPCSEC_GSS messages can leak memory in kadmind and cause a denial of service. No confidentiality or integrity impact is indicated.

Which deployments should be assessed first?

Assess systems running kadmind with MIT Kerberos 5, particularly versions 1.4 and later, because the affected routines are used by RPCSEC_GSS authentication.

UBUNTU-CVE-2026-112315: Medium severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploitation require valid credentials or user interaction?

What is the primary security impact to prioritize?

Which deployments should be assessed first?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require valid credentials or user interaction?

What is the primary security impact to prioritize?

Which deployments should be assessed first?