[31691] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Update for krb5-1.22.3
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:04:06 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170308.6B12010583D@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:03:08 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="===============4489918637210490728=="
Errors-To: cvs-krb5-bounces@mit.edu
--===============4489918637210490728==
Content-Type: text/plain
https://github.com/krb5/krb5/commit/f5bee90a501da6c351b3db46c1ae837b033a714c
commit f5bee90a501da6c351b3db46c1ae837b033a714c
Author: Greg Hudson <ghudson@mit.edu>
Date: Fri Nov 6 18:00:53 2026 -0500
Update for krb5-1.22.3
README | 182 +++++++++++++++++++++++++++++++++++++++++++++
src/man/k5identity.man | 2 +-
src/man/k5login.man | 2 +-
src/man/k5srvutil.man | 2 +-
src/man/kadm5.acl.man | 2 +-
src/man/kadmin.man | 2 +-
src/man/kadmind.man | 2 +-
src/man/kdb5_ldap_util.man | 2 +-
src/man/kdb5_util.man | 2 +-
src/man/kdc.conf.man | 2 +-
src/man/kdestroy.man | 2 +-
src/man/kerberos.man | 2 +-
src/man/kinit.man | 2 +-
src/man/klist.man | 2 +-
src/man/kpasswd.man | 2 +-
src/man/kprop.man | 2 +-
src/man/kpropd.man | 2 +-
src/man/kproplog.man | 2 +-
src/man/krb5-config.man | 2 +-
src/man/krb5.conf.man | 2 +-
src/man/krb5kdc.man | 2 +-
src/man/ksu.man | 2 +-
src/man/kswitch.man | 2 +-
src/man/ktutil.man | 2 +-
src/man/kvno.man | 2 +-
src/man/sclient.man | 2 +-
src/man/sserver.man | 2 +-
src/patchlevel.h | 6 +-
src/po/mit-krb5.pot | 4 +-
29 files changed, 213 insertions(+), 31 deletions(-)
diff --git a/README b/README
index 73eafa585..6d2c8bf37 100644
--- a/README
+++ b/README
@@ -97,6 +97,159 @@ removed.
Beginning with the krb5-1.18 release, all support for single-DES
encryption types has been removed.
+Major changes in 1.22.3 (2026-11-09)
+------------------------------------
+
+This is a bug fix release, with a focus on security issues discovered
+with the aid of large language models. See
+https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
+information on the risks of continuing to use unpatched releases.
+
+* Fix a logic error when checking PAC server checksums
+ [CVE-2026-111423].
+
+* Check for unkeyed checksums when validating CAMMAC verifiers
+ [CVE-2026-71199].
+
+* Fix a loophole in the KDC's client authdata filtering which could
+ allow clients to include fake PAC and CAMMAC authdata values when
+ requesting service tickets. These fake values would be rejected by
+ application servers, were it not for the two bugs noted above.
+
+* Check for the lockdown_keys attribute when processing password
+ change protocol requests in kadmind [CVE-2026-107884].
+
+* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
+ flavor, use the verified service type included in the RPC request to
+ determine how to unwrap arguments and wrap return values, instead of
+ the unverified service type included during authentication
+ [CVE-2026-118380].
+
+* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
+ "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI
+ is only needed for very old (pre-1.4) clients [CVE-2026-112322]
+ [CVE-2026-112323].
+
+* Fix numerous null pointer deferences, read overruns, unbounded
+ memory allocations, and memory leaks that could be used as denial of
+ service attacks against the KDC, kadmind, application servers, or
+ client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
+ [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
+ [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
+ [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
+ [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
+ [CVE-2026-119079].
+
+* Fix a client crash when a KKDCP proxy daemon closes the TLS session
+ without supplying any response data.
+
+* Shut down kpropd gracefully when a termination signal is received,
+ when operating in incremental propagation mode.
+
+* Detect when an incremental propagation update is applied to a
+ nonexistent principal; when this happens, force a full resync
+ instead of crashing.
+
+* Fix a KDC crash when the LDAP KDB module loses its connection to the
+ LDAP server.
+
+* Avoid a crash on macOS when the native API ccache type is used
+ before and after forking a process.
+
+* When an application accepts a GSS context without asking for
+ delegated credentials, discard any credentials sent by the initiator
+ without parsing them first.
+
+* On Windows, prevent buffer overflows when the KDC sends an
+ unexpectedly long prompt string via OTP preauthentication.
+
+* On Windows, move the default per-machine krb5.ini location from
+ C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as
+ the former location could be pre-created by an unutrusted user
+ before KfW installation.
+
+* On Windows, add error checking to kfwlogon to ensure that it does
+ not set ACLs on a cache file it did not create.
+
+* On Windows, prevent several buffer overflows that could occur if an
+ application passes a large principal name to leashdll APIs.
+
+* On Windows, prevent buffer overflows when the LSA cache contains
+ credentials with long principal name components.
+
+krb5-1.22.3 changes by ticket ID
+--------------------------------
+
+9191 Fix strchr() conformance to C23
+9201 Prevent read overrun in svc_auth_gssapi
+9205 Fix two NegoEx parsing vulnerabilities
+9206 Prevent read overrun in libkdb_ldap
+9209 Validate lengths when deserializing
+9210 Avoid asymmetric WSACleanup() in libkrb5
+9211 Avoid null dereference in krb5_rd_cred()
+9212 Fix error handling in KDC PAC processing
+9213 Fix null dereference in SPNEGO token processing
+9214 Fix gss_add_cred() extension fallback path
+9216 Always copy mech name_type for GSS union names
+9217 Fix triggerable assertion failure in gss_import_name()
+9218 Better validate key_data_ver in iprop decoding
+9219 Avoid another null dereference in krb5_rd_cred()
+9220 Check for empty forwarded creds in krb5 GSS mech
+9221 Propagate -laudit to simple audit module build
+9224 Prevent integer overrun in keytab parsing
+9227 Prevent null dereference in PKINIT CMS processing
+9228 Check for keyed checksums in CAMMAC verifiers
+9229 Exclude nested AD-IF-RELEVANT authdata in KDC
+9232 Prevent dangling result in tl_data2berval()
+9233 Prevent buffer overrun in old leashdll functions
+9234 Prevent read overruns in GSSRPC svcauth_unix
+9235 Free small client memory leak on OTP failure
+9236 Check for cache copy error in kfwlogon
+9238 Prevent null deref in KDC dispatch corner case
+9239 Check type of otherName value in PKINIT SAN code
+9240 Add space checks in Leash_krb5_kinit() prompter
+9241 Remove unsafe principal parsing from Leashdll
+9242 Check TXT lookup results on Windows
+9243 Fix gssalloc mismatches
+9244 Use safe string copies in MSLSA ccache type
+9245 Move krb5.ini from ProgramData to Program Files
+9246 Free call_arg on all AUTH_GSSAPI exit paths
+9247 Fix RPC leak when client switches from RPCSEC_GSS
+9248 Validate lengths when deserializing profiles
+9249 Improve libdb2 data validation
+9250 Fix two KDB data validation issues
+9251 Prevent KDC read overrun in ASN.1 decoder
+9252 Enforce lockdown bit in password change server
+9253 Correctly abort parse on invalid JSON array
+9254 Skip expired keys when iterating a KEYRING ccache
+9255 Free partial tl-data on XDR decode failure
+9256 Fix leaks when decoding GSS buffers in libgssrpc
+9257 Enforce XDR decode size limits
+9258 Fix leak in RPC client on mismatched ID
+9259 Check PAC server checksum verification result
+9260 Disable GSSRPC AUTH_GSSAPI flavor by default
+9261 Fix leak on error in xdr_krb5_keyblock()
+9262 Fix leak on error in xdr_krb5_principal()
+9263 Fix leak on error in process_chpw_request()
+9264 Fix memory leak in auth_gssapi_wrap_data()
+9265 Prevent null dereferences in kadmind server stubs
+9266 Avoid repeated reallocation when decoding ASN.1
+9267 Fix leaks in lifecycle of RPCSEC_GSS context
+9268 Fix leak on error in krb5_ktkdb_get_entry()
+9269 Fix leak on krb5 gss_accept_sec_context() failure
+9270 Pass through null deleg_cred from SPNEGO to mech
+9271 Fix leaks on error in PKINIT signed-data creation
+9272 Properly verify RPCSEC_GSS call arguments
+9273 Fix memory leak in mpool_get() error paths
+9274 Check reply length before V4 reply check
+9276 macOS API ccache crashes a child forked after the parent used it
+9277 Fix hex key input handling in ktutil addent
+9278 Prevent unsigned integer overflow in IAKERB
+9279 Fix use-after-free of LDAP handle after rebind
+9280 Detect iprop update of nonexistent principal
+9281 Shut down kpropd gracefully when in iprop mode
+9725 Terminate HTTPS read buffer when allocating it
+
Major changes in 1.22.2 (2026-01-29)
------------------------------------
@@ -370,6 +523,7 @@ reports, suggestions, and valuable resources:
Jeff Blaine
Toby Blake
Radoslav Bodo
+ Bogdan Boguslavskij
Alexander Bokovoy
Zoltan Borbely
Sumit Bose
@@ -380,9 +534,11 @@ reports, suggestions, and valuable resources:
Philip Brown
Samuel Cabrero
Michael Calmer
+ Luigino Camastra
Andrea Campi
Julien Chaffraix
Jacob Champion
+ Arthur Chan
Puran Chand
Ravi Channavajhala
Srinivas Cheruku
@@ -417,6 +573,7 @@ reports, suggestions, and valuable resources:
Francis Dupont
Viktor Dukhovni
Jason Edgecombe
+ Douglas Eichelberger
Mark Eichin
Shawn M. Emery
Douglas E. Engert
@@ -431,12 +588,14 @@ reports, suggestions, and valuable resources:
Remi Ferrand
Paul Fertser
Fabiano Fidêncio
+ Osvaldo Janeri Filho
Frank Filz
William Fiveash
Jacques Florent
Oliver Freyermuth
Ákos Frohner
Sebastian Galiano
+ Vidal Segura García
Ilya Gladyshev
Marcus Granado
Dylan Gray
@@ -455,12 +614,14 @@ reports, suggestions, and valuable resources:
Jochen Hein
Paul B. Henson
Kihong Heo
+ Jeremy Hitt
Jeff Hodges
Christopher Hogan
Love Hörnquist Åstrand
Ken Hornstein
Henry B. Hotz
Luke Howard
+ Rahul Hoysala
Jakub Hrozek
Shumon Huque
Jeffrey Hutzelman
@@ -471,10 +632,12 @@ reports, suggestions, and valuable resources:
Diogenes S. Jesus
Mike Jetzer
Pavel Jindra
+ Alexandru-Ionut Jipa
Brian Johannesmeyer
Joel Johnson
Lutz Justen
Ganesh Kamath
+ Cem Onat Karagun
Alexander Karaivanov
Anders Kaseorg
Bar Katz
@@ -486,6 +649,8 @@ reports, suggestions, and valuable resources:
Martin Kittel
Thomas Klausner
Tomasz Kłoczko
+ Brian Knoll
+ David Korczynski
Ivan Korytov
Matthew Krupcale
Mikkel Kruse
@@ -498,6 +663,7 @@ reports, suggestions, and valuable resources:
Chris Leick
Volker Lendecke
Jan iankko Lieskovsky
+ Erin Liman
Todd Lipcon
Oliver Loch
Chris Long
@@ -508,6 +674,7 @@ reports, suggestions, and valuable resources:
Todd Lubin
Ryan Lynch
Glenn Machin
+ Tristan Madani
Roland Mainz
Sorin Manolache
Robert Marshall
@@ -517,6 +684,7 @@ reports, suggestions, and valuable resources:
Greg McClement
Cameron Meadors
Vipul Mehta
+ Zvika Meiseles
Alexey Melnikov
Ivan A. Melnikov
Franklyn Mendez
@@ -524,9 +692,11 @@ reports, suggestions, and valuable resources:
Mantas Mikulėnas
Markus Moeller
Kyle Moffett
+ Alex Moore
Jon Moore
Paul Moore
Keiichi Mori
+ David Morash
Michael Morony
Robert Morris
Sam Morris
@@ -540,6 +710,8 @@ reports, suggestions, and valuable resources:
Michael Osipov
Andrej Ota
Dmitry Ovsyannikov
+ Haruki Oyama
+ Alejandro Pacheco
Dmitri Pal
Javier Palacios
Dilyan Palauzov
@@ -567,6 +739,7 @@ reports, suggestions, and valuable resources:
Solly Ross
Mike Roszkowski
Guillaume Rousse
+ Daniel Sands
Joshua Schaeffer
Alexander Scheel
Jens Schleusener
@@ -575,11 +748,14 @@ reports, suggestions, and valuable resources:
Eli Schwartz
Paul Seyfert
Tom Shaw
+ Ao Shen
+ Ze Sheng
Jim Shi
Jerry Shipman
Peter Shoults
Richard Silverman
Cel Skeggs
+ Tigran Sogomonian
Simo Sorce
Anthony Sottile
Michael Spang
@@ -587,14 +763,19 @@ reports, suggestions, and valuable resources:
Bjørn Tore Sund
Ondřej Surý
Joseph Sutton
+ Moritz Theile
Alexey Tikhonov
Joe Travaglini
+ Dmitrijs Trizna
Sergei Trofimovich
Greg Troxel
Fraser Tweedale
Tim Uglow
Rathor Vipin
+ Rickey Visinski
Denis Vlasenko
+ Guido Vranken
+ Sargun Vohra
Thomas Wagner
Jorgen Wahlsten
Stef Walter
@@ -606,6 +787,7 @@ reports, suggestions, and valuable resources:
Kevin Wasserman
Margaret Wasserman
Marcus Watts
+ Frederik Wedel-Heinen
Andreas Wiese
Simon Wilkinson
Nicolas Williams
diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 40962b7a4..129259fba 100644
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "K5IDENTITY" "5" " " "1.22.2" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.22.3" "MIT Kerberos"
.SH NAME
k5identity \- Kerberos V5 client principal selection rules
.SH DESCRIPTION
diff --git a/src/man/k5login.man b/src/man/k5login.man
index d0e327d1b..faf7c40e7 100644
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "K5LOGIN" "5" " " "1.22.2" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.22.3" "MIT Kerberos"
.SH NAME
k5login \- Kerberos V5 acl file for host access
.SH DESCRIPTION
diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index e926a1eb3..1b00230cf 100644
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "K5SRVUTIL" "1" " " "1.22.2" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
k5srvutil \- host key table (keytab) manipulation utility
.SH SYNOPSIS
diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index 95cf849d7..618a6df4b 100644
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KADM5.ACL" "5" " " "1.22.2" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.22.3" "MIT Kerberos"
.SH NAME
kadm5.acl \- Kerberos ACL file
.SH DESCRIPTION
diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index 15ddc17dc..ba2287d70 100644
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KADMIN" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kadmin \- Kerberos V5 database administration program
.SH SYNOPSIS
diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index 842b5082c..9a1bdb38f 100644
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KADMIND" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kadmind \- KADM5 administration server
.SH SYNOPSIS
diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 23461beaf..fd013fd9f 100644
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KDB5_LDAP_UTIL" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kdb5_ldap_util \- Kerberos configuration utility
.SH SYNOPSIS
diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index a777ad8ec..f3ac7171e 100644
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KDB5_UTIL" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kdb5_util \- Kerberos database maintenance utility
.SH SYNOPSIS
diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index ca82a2f17..6fa9d2648 100644
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KDC.CONF" "5" " " "1.22.2" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.22.3" "MIT Kerberos"
.SH NAME
kdc.conf \- Kerberos V5 KDC configuration file
.sp
diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index e91ed47d3..f52c3a75e 100644
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KDESTROY" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kdestroy \- destroy Kerberos tickets
.SH SYNOPSIS
diff --git a/src/man/kerberos.man b/src/man/kerberos.man
index 295d154c4..49b9f556c 100644
--- a/src/man/kerberos.man
+++ b/src/man/kerberos.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KERBEROS" "7" " " "1.22.2" "MIT Kerberos"
+.TH "KERBEROS" "7" " " "1.22.3" "MIT Kerberos"
.SH NAME
kerberos \- Overview of using Kerberos
.SH DESCRIPTION
diff --git a/src/man/kinit.man b/src/man/kinit.man
index 6153166a1..afbe5f456 100644
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KINIT" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kinit \- obtain and cache Kerberos ticket-granting ticket
.SH SYNOPSIS
diff --git a/src/man/klist.man b/src/man/klist.man
index aa5e44ab4..707106104 100644
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KLIST" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
klist \- list cached Kerberos tickets
.SH SYNOPSIS
diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index 0321cac4d..2055b5642 100644
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KPASSWD" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kpasswd \- change a user's Kerberos password
.SH SYNOPSIS
diff --git a/src/man/kprop.man b/src/man/kprop.man
index f3fc60a71..7c3de260d 100644
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KPROP" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kprop \- propagate a Kerberos V5 principal database to a replica server
.SH SYNOPSIS
diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index 182ecfe8b..92b2bc4f2 100644
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KPROPD" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kpropd \- Kerberos V5 replica KDC update server
.SH SYNOPSIS
diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 95a4b0800..5fb7cdc20 100644
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KPROPLOG" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
kproplog \- display the contents of the Kerberos principal update log
.SH SYNOPSIS
diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index ecc696a79..42dc5f98a 100644
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KRB5-CONFIG" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
krb5-config \- tool for linking against MIT Kerberos libraries
.SH SYNOPSIS
diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index eaba2b4cd..9eea6625f 100644
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KRB5.CONF" "5" " " "1.22.2" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.22.3" "MIT Kerberos"
.SH NAME
krb5.conf \- Kerberos configuration file
.sp
diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 3f38828b8..ad9a2ef59 100644
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KRB5KDC" "8" " " "1.22.2" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
krb5kdc \- Kerberos V5 KDC
.SH SYNOPSIS
diff --git a/src/man/ksu.man b/src/man/ksu.man
index e1f1c16ef..e4ee2340d 100644
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KSU" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KSU" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
ksu \- Kerberized super-user
.SH SYNOPSIS
diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 0ed5168aa..8ba80f046 100644
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KSWITCH" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kswitch \- switch primary ticket cache
.SH SYNOPSIS
diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index 53077975b..a5d03fc5f 100644
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KTUTIL" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
ktutil \- Kerberos keytab file maintenance utility
.SH SYNOPSIS
diff --git a/src/man/kvno.man b/src/man/kvno.man
index b63ba3b23..e73613ae7 100644
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "KVNO" "1" " " "1.22.2" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
kvno \- print key version numbers of Kerberos principals
.SH SYNOPSIS
diff --git a/src/man/sclient.man b/src/man/sclient.man
index 10976c05a..49e20895d 100644
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "SCLIENT" "1" " " "1.22.2" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.22.3" "MIT Kerberos"
.SH NAME
sclient \- sample Kerberos version 5 client
.SH SYNOPSIS
diff --git a/src/man/sserver.man b/src/man/sserver.man
index e60cb696d..90e0b0653 100644
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
-.TH "SSERVER" "8" " " "1.22.2" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.22.3" "MIT Kerberos"
.SH NAME
sserver \- sample Kerberos version 5 server
.SH SYNOPSIS
diff --git a/src/patchlevel.h b/src/patchlevel.h
index cc3689a86..1abb45492 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
*/
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 22
-#define KRB5_PATCHLEVEL 2
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 3
+/* #undef KRB5_RELTAIL */
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.22"
+#define KRB5_RELTAG "krb5-1.22.3-final"
diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index 248215373..f36de7adc 100644
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
#, fuzzy
msgid ""
msgstr ""
-"Project-Id-Version: mit-krb5 1.22.2-postrelease\n"
+"Project-Id-Version: mit-krb5 1.22.3\n"
"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-11-06 17:53-0500\n"
+"POT-Creation-Date: 2026-11-06 17:59-0500\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
--===============4489918637210490728==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
--===============4489918637210490728==--
