-
Type:
Task
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Server Security 2026-11-06
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Overview
Add an LSAN suppression for gss_acquire_cred_from to etc/lsan.suppressions on master.
Background
SERVER-137322 added ldap_gssapi_bind_timeout_sasl_deadlock.js, which runs a shell client that authenticates with GSSAPI. The system GSSAPI library leaks the credentials it acquires during client-side GSSAPI authentication, so LSAN reports a leak on sanitizer variants.
Scope of Work
Add the following entry to etc/lsan.suppressions:
# The system GSSAPI library leaks credentials acquired by client-side GSSAPI authentication. leak:gss_acquire_cred_from
Acceptance Criteria
- The suppression is on master.
- ldap_gssapi_bind_timeout_sasl_deadlock.js passes on LSAN/ASAN variants without a leak report.
- related to
-
SERVER-137322 Disconnecting an LDAP connection after a timed-out SASL bind can deadlock all SASL authentication
-
- Closed
-