{"id":"CVE-2026-85977","title":"Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding","summary":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unb…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-1050"],"vendor":"Red Hat","product":"libtirpc","affected":["libtirpc (all versions)","libtirpc (all versions)","libtirpc (all versions)","libtirpc (all versions)","libtirpc (all versions)","libtirpc (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:20:43.454Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85977","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-85977"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478979","label":"RHBZ#2478979"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.625Z","slug":"CVE-2026-85977","body":"## Overview\n\nA flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.\n\n## Affected\n\n- `libtirpc (all versions)`\n- `libtirpc (all versions)`\n- `libtirpc (all versions)`\n- `libtirpc (all versions)`\n- `libtirpc (all versions)`\n- `libtirpc (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, avoid configuring applications that use `pmap_getmaps()` to query untrusted or attacker-controlled portmapper services. If such functionality is essential, restrict network access for services utilizing `pmap_getmaps()` to only trusted hosts via firewall rules. Additionally, consider isolating client applications that call `pmap_getmaps()` into constrained environments to limit the impact of potential resource exhaustion.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}