libtirpc vulnerabilities
CVEs whose affected-version data names the libtirpc package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-85977Medium· 5.3Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unb…
CVE-2026-85231Medium· 6.5Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Securi…
CVE-2021-46828High· 7.5In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new conne…