RHSA-2026:99624HighCVSS 8.1

Red Hat Security Advisory: krb5 security, bug fix, and enhancement update

Published
November 12, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (19)

CVE-2026-112319 →CVE-2026-107778 →CVE-2026-112315 →CVE-2026-118380 · no recordCVE-2026-107884 · no recordCVE-2026-112316 →CVE-2026-112317 →CVE-2026-112320 →CVE-2026-112321 →CVE-2026-112322 →CVE-2026-112323 →CVE-2026-71200 · no recordCVE-2026-107364 · no recordCVE-2026-112318 →CVE-2026-119079 →CVE-2026-71199 · no recordCVE-2026-107708 →CVE-2026-111423 · no recordCVE-2026-112314 →

📋 Description

CVE-2026-71199 — krb5: Alteration of authentication indicators in CAMMAC container CVE-2026-71200 — krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request CVE-2026-107364 — krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun CVE-2026-107708 — krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests CVE-2026-107778 — krb5: krb5: Denial of Service via crafted forwarded credentials CVE-2026-107884 — krb5: Unauthorized key reset of protected principal via kpasswd CVE-2026-111423 — krb5: Improper authorization via flawed PAC checksum verification CVE-2026-112314 — krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries CVE-2026-112315 — krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure CVE-2026-112316 — krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure CVE-2026-112317 — krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path CVE-2026-112318 — krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers CVE-2026-112319 — krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation CVE-2026-112320 — krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching CVE-2026-112321 — krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths CVE-2026-112322 — krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup CVE-2026-112323 — krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests CVE-2026-118380 — krb5: kadmind: request alteration and protected information disclosure CVE-2026-119079 — krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding

🎯 Affected products107

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-0:1.21.3-11.el10_3.2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debuginfo-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-debugsource-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-devel-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-devel-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-devel-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-devel-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-libs-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-libs-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-libs-0:1.21.3-11.el10_3.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-libs-0:1.21.3-11.el10_3.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-libs-debuginfo-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • krb5-libs-debuginfo-0:1.21.3-11.el10_3.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • krb5-libs-debuginfo-0:1.21.3-11.el10_3.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +77 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Disable PKINIT on the KDC if certificate-based authentication is not required, or restrict network access to the KDC service using firewall rules. 1. Disabling PKINIT: Edit `/var/kerberos/krb5kdc/kdc.conf` and comment out or remove the `pkinit_identity` and `pkinit_anchors` directives within the realm configuration: ``` # pkinit_identity = FILE:/etc/krb5kdc/kdc.pem,/etc/krb5kdc/kdckey.pem # pkinit_anchors = FILE:/etc/krb5kdc/cacert.pem ``` Apply the changes by restarting the service: ``` systemctl restart krb5kdc.service ``` 2. Restricting Network Access: If PKINIT cannot be disabled, restrict network access to port 88 (UDP/TCP) to trusted client subnets using firewalld: ``` firewall-cmd --permanent --zone=internal --add-service=kerberos firewall-cmd --permanent --zone=internal --add-source=192.168.1.0/24 firewall-cmd --reload ``` Caveats: Disabling PKINIT prevents users and services from using smart cards or X.509 certificate pre-authentication. Restricting network access prevents unlisted subnets from obtaining Kerberos tickets. Warning: Restarting `krb5kdc.service` will cause a momentary interruption to active authentication requests. Workaround: Restrict network access to the Kerberos Key Distribution Center (KDC) ports (88 UDP/TCP) to trusted client networks, or disable the KDC service on systems not operating as identity controllers. To stop and disable the KDC service on systems where it is not required: systemctl stop krb5kdc systemctl disable krb5kdc To restrict network access to an authorized client subnet (e.g., 192.168.1.0/24) using firewalld: firewall-cmd --permanent --zone=public --remove-service=kerberos firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="kerberos" accept' firewall-cmd --reload Caveat: Disabling the service or blocking network traffic prevents unlisted clients from obtaining Kerberos tickets, which will disrupt authentication and single sign-on services in the realm. Warning: Reloading firewall rules or stopping the KDC service will immediately terminate active Kerberos connections and fail in-flight ticket requests. Workaround: Audit Kerberos access controls to ensure delegated password-change permissions are not assigned over protected accounts, or restrict network reachability to the kpasswd service. 1. Review the administrative ACL file (typically `/var/kerberos/krb5kdc/kadm5.acl`) and remove entries granting `c` (change-password) permissions over principals configured with `+lockdown_keys`. Restart the Kerberos administration daemon to apply the change: ``` systemctl restart kadmin.service ``` 2. If remote password changes are not required or should be restricted to trusted administration networks, remove the kpasswd service from the public firewall zone or configure rich rules to limit access to port 464: ``` firewall-cmd --permanent --remove-service=kpasswd firewall-cmd --reload ``` Warning: Modifying ACL permissions will stop delegated operators from performing password changes on those targets. Restricting or blocking port 464 will prevent clients from performing network password changes via kpasswd. Restarting `kadmin.service` or reloading `firewalld` may cause a momentary interruption to active administrative sessions and network traffic. Workaround: Restrict network access to kadmind to trusted hosts, or disable it in favor of kadmin.local server-side command line tool for administration operations if possible. Workaround: If remote administration of the Kerberos Key Distribution Center (KDC) is not required, stop and mask the kadmind service and manage the realm locally using kadmin.local: ``` systemctl stop kadmin.service systemctl mask kadmin.service ``` If remote administration is required, restrict network access to the Kerberos administration port (port 749/tcp) to authorized administrator IP addresses or dedicated management subnets using firewalld: ``` firewall-cmd --permanent --zone=drop --add-port=749/tcp firewall-cmd --permanent --zone=trusted --add-source=<ADMIN_SUBNET> firewall-cmd --permanent --zone=trusted --add-port=749/tcp firewall-cmd --reload ``` Caveats: Disabling the kadmind service prevents remote administrative operations via the kadmin client, requiring administrators to execute kadmin.local directly on the KDC host. Restricting or reloading firewall rules will disrupt unauthorized remote sessions and may momentarily interrupt active network connections during rule application. Workaround: Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld. 1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR): firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept' 2. Ensure unauthenticated or public access to port 88/tcp is removed: firewall-cmd --permanent --remove-port=88/tcp 3. Apply the changes: firewall-cmd --reload Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.

🔗 References (22)