The AUTH_GSSAPI handler in MIT Kerberos 5 does not free decoded arguments on certain error paths. When a remote attacker sends crafted AUTH_GSSAPI_INIT requests that trigger authentication failures, this causes a memory leak in the kadmind daemon, eventually exhausting system memory and bringing the service down. The flaw is an unauthenticated denial‑of‑service vulnerability that can affect any kadmind instance that accepts GSSAPI authentication.

The vulnerability affects Red Hat Enterprise Linux 10, 6, 7, 8, 9, and the Red Hat Hardened Images product line. All listed OS releases are impacted; specific version ranges are not delineated in the advisory, so any installation of the affected RHEL releases should be considered vulnerable until a patch is applied.

With a CVSS score of 7.5, this flaw is classified as high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of a KEV listing suggests no confirmed widespread exploitation at the time of publication. The attack vector is remote, requiring network connectivity to the kadmind service; an attacker does not need valid credentials. Once commanded, the memory exhaustion can render Kerberos administration impossible until the service is restarted or the system is rebooted.