RHSA-2026:99625 - Security Advisory

Topic

An update for krb5 is now available for Red Hat Enterprise Linux 10.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

• krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests (CVE-2026-112323)
• krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)
• krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)
• krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200)
• krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths (CVE-2026-112321)
• krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320)
• krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)
• krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319)
• krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318)
• krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317)
• krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)
• krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure (CVE-2026-112316)
• krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)
• krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure (CVE-2026-112315)
• krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)
• krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)
• krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)
• krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)
• krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

Bug Fix(es) and Enhancement(s):

• Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.2.z] (JIRA:RHEL-278062)
• auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.2.z] (JIRA:RHEL-296011)
• xdr_bytes() does not free its allocation on partial decode failure [rhel-10.2.z] (JIRA:RHEL-296022)
• RPCSEC_GSS context lifecycle leaks [rhel-10.2.z] (JIRA:RHEL-296033)
• xdr_krb5_principal decode leak [rhel-10.2.z] (JIRA:RHEL-296044)
• process_chpw_request leak [rhel-10.2.z] (JIRA:RHEL-296055)
• Read overruns in GSSRPC svcauth_unix [rhel-10.2.z] (JIRA:RHEL-296066)
• Null dereference in KDC dispatch corner case [rhel-10.2.z] (JIRA:RHEL-296079)
• KDC DoS based on otherName value in PKINIT SAN code [rhel-10.2.z] (JIRA:RHEL-296093)
• Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.2.z] (JIRA:RHEL-296111)
• KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-10.2.z] (JIRA:RHEL-296126)
• Dereference of empty first credential list element in GSS mechanism [rhel-10.2.z] (JIRA:RHEL-296996)
• Null dereference of principal names in krb5_rd_cred() [rhel-10.2.z] (JIRA:RHEL-296999)
• Fix validation issues for trusted inputs [rhel-10.2.z] (JIRA:RHEL-299156)
• Skip expired keys when iterating over KEYRING ccache [rhel-10.2.z] (JIRA:RHEL-299157)
• Fix ksu memory leak in fcmd_resolve() [rhel-10.2.z] (JIRA:RHEL-299158)
• Prevent unsigned int overflow in iakerb_save_token() [rhel-10.2.z] (JIRA:RHEL-299159)
• json: Correctly abort parse on invalid array [rhel-10.2.z] (JIRA:RHEL-299160)
• Fix memory leak in mpool_get() error paths [rhel-10.2.z] (JIRA:RHEL-299161)
• Check reply length before V4 reply check [rhel-10.2.z] (JIRA:RHEL-299162)
• Fix hex key input handling in ktutil addent [rhel-10.2.z] (JIRA:RHEL-299163)
• Fix leaks on error in PKINIT signed-data creation [rhel-10.2.z] (JIRA:RHEL-299164)
• Pass through null deleg_cred from SPNEGO to mech [rhel-10.2.z] (JIRA:RHEL-299165)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x

Fixes

• BZ - 2478440 - CVE-2026-112323 krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests
• BZ - 2478445 - CVE-2026-112322 krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup
• BZ - 2478446 - CVE-2026-112314 krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries
• BZ - 2478447 - CVE-2026-71200 krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request
• BZ - 2478448 - CVE-2026-112321 krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths
• BZ - 2478449 - CVE-2026-112320 krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching
• BZ - 2478672 - CVE-2026-107884 krb5: Unauthorized key reset of protected principal via kpasswd
• BZ - 2478684 - CVE-2026-112319 krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation
• BZ - 2478792 - CVE-2026-112318 krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers
• BZ - 2479209 - CVE-2026-112317 krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path
• BZ - 2479231 - CVE-2026-119079 krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding
• BZ - 2479331 - CVE-2026-112316 krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure
• BZ - 2479394 - CVE-2026-111423 krb5: Improper authorization via flawed PAC checksum verification
• BZ - 2479403 - CVE-2026-112315 krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure
• BZ - 2548262 - CVE-2026-107708 krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests
• BZ - 2548269 - CVE-2026-107778 krb5: krb5: Denial of Service via crafted forwarded credentials
• BZ - 2563453 - CVE-2026-71199 krb5: Alteration of authentication indicators in CAMMAC container
• BZ - 2563461 - CVE-2026-118380 krb5: kadmind: request alteration and protected information disclosure
• BZ - 2569161 - CVE-2026-107364 krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun

CVEs

• CVE-2026-71199
• CVE-2026-71200
• CVE-2026-107364
• CVE-2026-107708
• CVE-2026-107778
• CVE-2026-107884
• CVE-2026-111423
• CVE-2026-112314
• CVE-2026-112315
• CVE-2026-112316
• CVE-2026-112317
• CVE-2026-112318
• CVE-2026-112319
• CVE-2026-112320
• CVE-2026-112321
• CVE-2026-112322
• CVE-2026-112323
• CVE-2026-118380
• CVE-2026-119079

References

• https://access.redhat.com/security/updates/classification/#important