UBUNTU-CVE-2026-112317: Medium severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

krb5ktkdbgetentry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which services are exposed to this issue?

The affected code can leak memory in the KDC or kadmind. Systems not running either of those Kerberos services are not identified as exposed by the available information.

What does an attacker need to do to trigger the denial of service?

An attacker can send requests that repeatedly cause key decryption to fail after decryption, triggering the memory leak. The vector is network-based and requires no privileges or user interaction.

What is the likely operational impact?

Repeated triggering can consume memory in the KDC or kadmind and cause a denial of service. No confidentiality or integrity impact is indicated by the provided severity vector.

UBUNTU-CVE-2026-112317: Medium severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which services are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the likely operational impact?

Company

Resources

Contact

Frequently Asked Questions

Which services are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the likely operational impact?