CVE-2026-85231
MediumCVSS 6.5Summary
A flaw was found in libtirpc allowing an authenticated remote attacker to send oversized wrapped data requests to an RPC service configured with RPCSEC_GSS integrity or privacy. This leads to unbounded memory allocation and a denial of service (DoS) by exhausting system resources, causing the service to become unstable or terminate.
Risk Assessment
An authenticated attacker can exhaust system resources and cause instability or termination of the RPC service, potentially disrupting dependent applications.
Recommendation
Apply available libtirpc updates containing the fix or restrict access to RPCSEC_GSS RPC services to trusted clients.
Other vulnerabilities in libtirpc
See all- CVE-2026-85977Medium
A flaw was found in libtirpc involving unbounded decoding of PMAPPROC_DUMP replies. A remote attacker can send specially crafted replies to a client application using the pmap_getmaps() function against an attacker-controlled host, causing excessive memory and CPU allocation and a denial of service (DoS) in the client process due to resource exhaustion.
- CVE-2021-46828High
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.
Original NVD description (English source)
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS