Every CVE Search/ Get API key

CVE-2021-46828

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process...

7.5 HighFix available

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.20%Up 2.1 points since Jul 20, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-755, CWE-835
Updated
2026-11-02
CVE List 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-755
Updated
2026-11-02
EUVDEUVD-2021-33483 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
EUVD-2021-33483
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-x62c-6mxr-74fh 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process...

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
GHSA-x62c-6mxr-74fh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-755, CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2021-46828 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
ALPINE-CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-46828 7.5

CVE-2021-46828 does not affect BellSoft software

Record
BELL-CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 15 moreShow less
OSV 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-46828 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
DEBIAN-CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-1289 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
JLSEC-2026-1289
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-1795 7.5

libtirpc security update

Libtirpc is a Transport-Independent RPC library for Linux

Security Fix(es):

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.(CVE-2021-46828)

Record
OESA-2022-1795
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHBA-2022:2065 7.5

Red Hat Bug Fix Advisory: libtirpc bug fix and enhancement update

Record
RHBA-2022:2065
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:8400 7.5

Red Hat Security Advisory: libtirpc security update

Record
RHSA-2022:8400
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2022:8400 7.5

Moderate: libtirpc security update

The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages.

Security Fix(es):

  • libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Record
RLSA-2022:8400
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-46828 7.5

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Record
UBUNTU-CVE-2021-46828
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:8400 No score

Moderate: libtirpc security update

The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages.

Security Fix(es):

  • libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:8400
Updated
2026-11-02
OSVMGASA-2022-0288 No score

Updated libitrpc packages fix security vulnerability

It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service (CVE-2021-46828).

Record
MGASA-2022-0288
Updated
2026-11-02
OSVopenSUSE-SU-2024:12278-1 No score

libtirpc-devel-1.3.3-1.1 on GA media

These are all security issues fixed in the libtirpc-devel-1.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12278-1
Updated
2026-11-02
OSVSUSE-SU-2022:2991-1 No score

Security update for libtirpc

This update for libtirpc fixes the following issues:

  • CVE-2021-46828: Fixed an uncontrolled file descriptor consumption, which could be exploited by remote attackers to prevent applications using the library from accepting new connections (bsc#1201680).

Non-security fixes:

  • Exclude ipv6 addresses in client protocol version 2 code (bsc#1200800)
  • Fix memory leak in params.r_addr assignement (bsc#1198752)
Record
SUSE-SU-2022:2991-1
Updated
2026-11-02
OSVSUSE-SU-2022:3305-1 No score

Security update for libtirpc

This update for libtirpc fixes the following issues:

  • CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680).
Record
SUSE-SU-2022:3305-1
Updated
2026-11-02
OSVSUSE-SU-2022:3791-1 No score

Security update for libtirpc

This update for libtirpc fixes the following issues:

  • CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680).

  • Exclude ipv6 addresses in client protocol version 2 code (bsc#1200800)

Record
SUSE-SU-2022:3791-1
Updated
2026-11-02
OSVUSN-5538-1 No score

libtirpc vulnerability

It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.

Record
USN-5538-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtirpc
Alpine:v3.13
 before 1.3.1-r1
1.3.1-r1
libtirpc
Alpine:v3.14
 before 1.3.2-r1
1.3.2-r1
libtirpc
Alpine:v3.15
 before 1.3.2-r1
1.3.2-r1
libtirpc
Alpine:v3.16
 before 1.3.2-r1
1.3.2-r1
libtirpc
Alpine:v3.17
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.18
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.19
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.20
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.21
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.22
 before 1.3.2-r2
1.3.2-r2
Show 63 moreShow less
Affected packages
PackageAffectedFixed
libtirpc
Alpine:v3.23
 before 1.3.2-r2
1.3.2-r2
libtirpc
Alpine:v3.24
 before 1.3.2-r2
1.3.2-r2
libtirpc
AlmaLinux:9
 before 1.3.3-0.el9
1.3.3-0.el9
libtirpc-devel
AlmaLinux:9
 before 1.3.3-0.el9
1.3.3-0.el9
libtirpc
Debian:12
 before 1.3.2-2.1
1.3.2-2.1
libtirpc
Debian:13
 before 1.3.2-2.1
1.3.2-2.1
libtirpc
Debian:14
 before 1.3.2-2.1
1.3.2-2.1
libtirpc
Debian:10
 before 1.1.4-0.4+deb10u1, plus listed versions
1.1.4-0.4
1.1.4-0.4+deb10u1
libtirpc
Debian:11
 before 1.3.1-1+deb11u1, plus listed versions
1.3.1-1
1.3.1-1+deb11u1
libtirpc_jll
Julia
 before 1.3.7+0
1.3.7+0
libtirpc
Mageia:8
 before 1.3.3-1.mga8
1.3.3-1.mga8
libtirpc
openEuler:20.03-LTS-SP1
 before 1.2.6-2.oe1
1.2.6-2.oe1
libtirpc
openEuler:20.03-LTS-SP3
 before 1.2.6-2.oe1
1.2.6-2.oe1
libtirpc
openEuler:22.03-LTS
 before 1.3.2-2.oe2203
1.3.2-2.oe2203
libtirpc
Red Hat:enterprise_linux:8::baseos
 before 0:1.1.4-6.el8
0:1.1.4-6.el8
libtirpc-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.1.4-6.el8
0:1.1.4-6.el8
libtirpc-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.1.4-6.el8
0:1.1.4-6.el8
libtirpc-devel
Red Hat:enterprise_linux:8::baseos
 before 0:1.1.4-6.el8
0:1.1.4-6.el8
libtirpc
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc-devel
Red Hat:enterprise_linux:9::crb
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc
Rocky Linux:9
 before 0:1.3.3-0.el9
0:1.3.3-0.el9
libtirpc
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server 15-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 15
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Manager Proxy 4.1
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Manager Retail Branch Server 4.1
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Manager Server 4.1
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Enterprise Storage 6
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Enterprise Storage 7
 before 1.0.2-150000.3.18.1
1.0.2-150000.3.18.1
libtirpc
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
SUSE:Linux Enterprise Micro 5.1
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
SUSE:Linux Enterprise Micro 5.2
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
openSUSE:Leap Micro 5.2
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
openSUSE:Leap 15.3
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
openSUSE:Leap 15.4
 before 1.2.6-150300.3.14.1
1.2.6-150300.3.14.1
libtirpc
SUSE:OpenStack Cloud 9
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:OpenStack Cloud Crowbar 9
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server 12 SP5
 before 1.0.1-17.24.1
1.0.1-17.24.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.0.1-17.24.1
1.0.1-17.24.1
ntirpc
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.3.1-1
 None known
libtirpc
Ubuntu:20.04:LTS
 before 1.2.5-1ubuntu0.1, plus listed versions
1.1.4-0.41.1.4-11.2.5-1
1.2.5-1ubuntu0.1
libtirpc
Ubuntu:22.04:LTS
 before 1.3.2-2ubuntu0.1, plus listed versions
1.3.2-21.3.2-2build1
1.3.2-2ubuntu0.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-46828 is a high vulnerability (CVSS 7.5) in Libtirpc Project Libtirpc, published July 20, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in libtirpc 1.3.1-r1.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open