The GSS‑RPC layer in MIT Kerberos 5 does not impose size limits on XDR‑decoded data, allowing authenticated users to craft RPC requests that trigger unbounded memory allocations while decoding. This behavior causes the kadmind service to consume excessive memory or CPU, resulting in a denial of service. The flaw is classified as CWE‑770.

Affected systems include all supported Red Hat Enterprise Linux releases from version 6 through 9, including Red Hat Hardened Images. The vulnerability also applies to Red Hat Enterprise Linux 10 and the Extended Life Cycle Support branches for RHEL 6 and RHEL 7.

Risk assessment shows a CVSS base score of 6.5, indicating moderate severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must possess valid Kerberos credentials and access to kadmind, so the likely attack vector is authenticated remote. Given the lack of a vendor patch, the scenario remains theoretical until an update is released.