UBUNTU-CVE-2026-112322: High severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

cleanclient() in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTHGSSAPI client entries.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this denial of service?

Systems running Ubuntu's krb5 package are affected when kadmind is exposed to remote clients that can create AUTH_GSSAPI client entries. The impact is CPU consumption in kadmind, which can degrade or deny service.

What does an attacker need to exploit the issue?

The attacker can act remotely and does not require privileges or user interaction. Exploitation involves accumulating a large number of AUTH_GSSAPI client entries, triggering inefficient cleanup processing.

Is confidentiality or data integrity affected?

The provided severity vector indicates no confidentiality or integrity impact. The stated impact is availability loss through high CPU consumption in kadmind.

UBUNTU-CVE-2026-112322: High severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this denial of service?

What does an attacker need to exploit the issue?

Is confidentiality or data integrity affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this denial of service?

What does an attacker need to exploit the issue?

Is confidentiality or data integrity affected?