RLSA-2026:99624

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

• krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests (CVE-2026-112323)

• krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322)

• krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

• krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200)

• krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths (CVE-2026-112321)

• krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320)

• krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

• krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319)

• krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318)

• krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317)

• krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

• krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure (CVE-2026-112316)

• krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

• krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure (CVE-2026-112315)

• krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

• krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

• krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

• krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

• krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

Bug Fix(es) and Enhancement(s):

• Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:Rocky Linux-278063)

• auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.3.z] (JIRA:Rocky Linux-296012)

• xdr_bytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:Rocky Linux-296023)

• RPCSEC_GSS context lifecycle leaks [rhel-10.3.z] (JIRA:Rocky Linux-296034)

• xdr_krb5_principal decode leak [rhel-10.3.z] (JIRA:Rocky Linux-296045)

• process_chpw_request leak [rhel-10.3.z] (JIRA:Rocky Linux-296056)

• Read overruns in GSSRPC svcauth_unix [rhel-10.3.z] (JIRA:Rocky Linux-296067)

• Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:Rocky Linux-296081)

• KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:Rocky Linux-296095)

• Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.3.z] (JIRA:Rocky Linux-296112)

• KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-10.3.z] (JIRA:Rocky Linux-296127)

• Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:Rocky Linux-296997)

• Null dereference of principal names in krb5_rd_cred() [rhel-10.3.z] (JIRA:Rocky Linux-297000)

• Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:Rocky Linux-299144)

• Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:Rocky Linux-299145)

• Pass through null deleg_cred from SPNEGO to mech [rhel-10.3.z] (JIRA:Rocky Linux-299146)

• Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:Rocky Linux-299147)

• Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:Rocky Linux-299148)

• Check reply length before V4 reply check [rhel-10.3.z] (JIRA:Rocky Linux-299149)

• Fix memory leak in mpool_get() error paths [rhel-10.3.z] (JIRA:Rocky Linux-299150)

• json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:Rocky Linux-299151)

• Prevent unsigned int overflow in iakerb_save_token() [rhel-10.3.z] (JIRA:Rocky Linux-299152)

• Fix ksu memory leak in fcmd_resolve() [rhel-10.3.z] (JIRA:Rocky Linux-299153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.