---
id: CVE-2026-85977
title: >-
  Libtirpc: libtirpc: denial of service via unbounded memory allocation during
  portmapper response decoding
summary: >-
  A flaw was found in libtirpc. A remote attacker can exploit this vulnerability
  by sending specially crafted PMAPPROC_DUMP replies to a client application
  that uses the pmap_getmaps() function against an attacker-controlled host.
  This unb…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1050
vendor: Red Hat
product: libtirpc
affected:
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - libtirpc (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:20:43.454Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85977'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85977'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2478979'
    label: RHBZ#2478979
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.625Z'
---

## Overview

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

## Affected

- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `libtirpc (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, avoid configuring applications that use `pmap_getmaps()` to query untrusted or attacker-controlled portmapper services. If such functionality is essential, restrict network access for services utilizing `pmap_getmaps()` to only trusted hosts via firewall rules. Additionally, consider isolating client applications that call `pmap_getmaps()` into constrained environments to limit the impact of potential resource exhaustion.