---
id: CVE-2026-85231
title: >-
  Libtirpc: libtirpc: denial of service via unbounded memory allocation during
  rpcsec_gss decoding
summary: >-
  A flaw was found in libtirpc. An authenticated remote attacker could exploit
  this vulnerability by sending oversized wrapped data requests to an RPC
  (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure
  Call Securi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: Red Hat
product: libtirpc
affected:
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:09:58.126991Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:10:28.515Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85231'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85231'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2478512'
    label: RHBZ#2478512
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.624Z'
---

## Overview

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.

## Affected

- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To reduce exposure, disable RPCSEC_GSS integrity or privacy modes on externally reachable RPC services where feasible. Implement strict request or transport record size limits in the embedding RPC service before wrapped blob decoding. Additionally, consider using process memory limits or supervision to contain single-process memory exhaustion.