UBUNTU-CVE-2026-112323: High severity ubuntu/krb5 vulnerability

Published Nov 10, 2026

Updated

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTHGSSAPIINIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.

Affected Software

8 affected components

ubuntu/krb5*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the MIT Kerberos kadmind service are exposed because the affected AUTH_GSSAPI handler allocates state in kadmind. The issue applies to MIT Kerberos 5 versions 1.5.2 and later; the provided data does not identify specific Ubuntu package builds.

What does an attacker need to exploit it?

An attacker can exploit the issue remotely with no privileges or user interaction by repeatedly sending failed AUTH_GSSAPI_INIT requests. Successful authentication is not required because the requests are specifically failed initialization attempts.

What is the operational impact?

Repeated requests can exhaust kadmind memory and cause a denial of service. Client state from each failed request remains allocated until its 15-minute expiration timeout, allowing allocations to outpace reclamation.

UBUNTU-CVE-2026-112323: High severity ubuntu/krb5 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact?