CVE-2024-26461

A memory leak flaw was found in krb5 in /krb5/src/lib/gssapi/krb5/k5sealv3.c. This issue can lead to a denial of service through memory exhaustion.

In the file k5sealv3.c, a variable named plain is defined and its address is passed to alloc_data. Inside alloc_data, plain is called data, and calloc allocates memory for ptr, which is assigned to data->data. If an if condition evaluates to true, the program jumps to an error label using a goto statement, leaving the memory allocated to plain unused and unreleased, leading to a memory leak defect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.