The vulnerability lies in the clnttcp_call() function of MIT Kerberos 5, where the RPC reply verifier is not freed between retries. An attacker able to send crafted RPC replies with mismatched transaction identifiers, or force authentication retries, can trigger uncontrolled memory allocation in GSS‑RPC client programs, gradually exhausting available memory and causing a denial of service. This is a classic resource exhaustion flaw, classified as a missing release of memory or resources.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images and Red Hat Enterprise Linux ELS 6 and 7 are affected. The vulnerability applies to the account and networking components that use the mit krb5 gss‑rpc interface on these distributions.

The CVSS score of 7.5 indicates medium to high severity. No EPSS score is reported, so the likelihood of automated exploitation is currently unclear. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation at this time. Attackers would need network access to a Kerberos service that accepts RPC traffic, and the ability to inject or influence the RPC replies. Once an attacker achieves this, the memory leak can progressively deplete system resources, leading to service disruption.