UBUNTU-CVE-2026-112316: Medium severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

xdrkrb5tldata() in lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to authenticate and send crafted RPC requests to kadmind. The attack does not require user interaction.

What is the practical impact?

Repeated requests that trigger decoding failures can leak memory in kadmind, potentially exhausting available memory and causing a denial of service. The provided data does not indicate confidentiality or integrity impact.

Which component should be prioritized for investigation?

Prioritize systems running the kadmind service, because the memory leak occurs in kadmind while processing RPC data. Systems using krb5 but not exposing or running kadmind are not identified by the provided data as the direct affected service.

How can I look for exploitation attempts?

Review kadmind logs and monitoring for malformed or failed RPC decode activity, along with unexplained sustained memory growth or service instability. The provided data does not include specific log messages or request indicators.

UBUNTU-CVE-2026-112316: Medium severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which component should be prioritized for investigation?

How can I look for exploitation attempts?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which component should be prioritized for investigation?

How can I look for exploitation attempts?