Is CVE-2026-112314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112314 being exploited in the wild.

How severe is CVE-2026-112314?

High severity, with a CVSS score of 7.5, published 9 November 2026.

Is there a fix for CVE-2026-112314?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112314 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112314?

Check whether you run Mit Kerberos 5. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112314: MIT Kerberos 5 memory leak in RPC client

CVE-2026-112314 · Severity: high · CVSS 7.5 · Published 2026-11-09

MIT Kerberos 5 is authentication software used by many enterprise systems. A memory leak in its RPC client can be triggered by a remote attacker injecting malformed network responses, causing Kerberos client applications to exhaust memory and stop functioning. This is a denial-of-service attack that requires network access but does not compromise confidentiality or user authentication itself.

Technologies: Mit Kerberos 5. Vendors: Mit.

Quick answers

Is CVE-2026-112314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112314 being exploited in the wild.
How severe is CVE-2026-112314?: High severity, with a CVSS score of 7.5, published 9 November 2026.
Which products and versions are affected?: MIT Kerberos 5.
Is there a fix for CVE-2026-112314?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112314 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112314?: Check whether you run Mit Kerberos 5. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The clnttcp_call() function in lib/rpc/clnt_tcp.c fails to deallocate RPC reply verifiers on retries, leading to memory exhaustion in GSS-RPC client programs. An attacker can trigger this by injecting RPC replies with mismatched XIDs or forcing authentication retries across an uncontrolled network. Exploitation requires continuous malformed responses during active transactions but does not affect servers or authentication data integrity.

Affected products

MIT Kerberos 5

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.