CVE-2026-85231
Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
CVE-2026-85231- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-06
EUVDEUVD-2026-103019
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
EUVD-2026-103019- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-xhf3-w45r-cmh3
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability...
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
GHSA-xhf3-w45r-cmh3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
CVE-2026-85231- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-06
OSVBELL-CVE-2026-85231
- Record
BELL-CVE-2026-85231- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-85231
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
DEBIAN-CVE-2026-85231- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-85231
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
- Record
UBUNTU-CVE-2026-85231- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12244-1 No score
libtirpc-devel-1.3.8-1.1 on GA media
These are all security issues fixed in the libtirpc-devel-1.3.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12244-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libtirpcAlpaquita:23 |
1.3.3-r0 and later | None known |
libtirpcAlpaquita:25 |
1.3.5-r0 and later | None known |
libtirpcAlpaquita:stream |
1.3.3-r0 and later | None known |
libtirpcDebian:12 |
All versions, plus listed versions 1.3.3+ds-11.3.4+ds-11.3.4+ds-1.11.3.4+ds-1.1~exp11.3.4+ds-1.1~exp2 Show 5 moreShow less1.3.4+ds-1.21.3.4+ds-1.31.3.6+ds-11.3.7+ds-11.3.7-0.1 |
None known |
libtirpcDebian:13 |
All versions, plus listed versions 1.3.6+ds-11.3.7+ds-11.3.7-0.1 |
None known |
libtirpcDebian:14 |
All versions, plus listed versions 1.3.6+ds-11.3.7+ds-11.3.7-0.1 |
None known |
libtirpcUbuntu:14.04:LTS |
All versions, plus listed versions 0.2.2-5ubuntu10.2.2-5ubuntu20.2.2-5ubuntu2.1 |
None known |
libtirpcUbuntu:16.04:LTS |
All versions, plus listed versions 0.2.5-10.2.5-1ubuntu0.1 |
None known |
ntirpcUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.1-1 |
None known |
libtirpcUbuntu:18.04:LTS |
All versions, plus listed versions 0.2.5-1.20.2.5-1.2ubuntu0.1 |
None known |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntirpcUbuntu:18.04:LTS |
All versions, plus listed versions 1.4.4-11.5.3-11.6.1-1 |
None known |
libtirpcUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.4-0.41.1.4-11.2.5-11.2.5-1ubuntu0.1 |
None known |
ntirpcUbuntu:20.04:LTS |
All versions, plus listed versions 1.7.4-23.0-0ubuntu13.0-0ubuntu2 |
None known |
libtirpcUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-21.3.2-2build11.3.2-2ubuntu0.1 |
None known |
ntirpcUbuntu:22.04:LTS |
All versions, plus listed versions 3.4-2build13.4-2build23.5-13.5-2 |
None known |
libtirpcUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.3+ds-11.3.4+ds-11.3.4+ds-1build11.3.4+ds-1.11.3.4+ds-1.1build1 |
None known |
ntirpcUbuntu:24.04:LTS |
All versions, plus listed versions 4.3-24.3-34.3-3.14.3-3.1build14.3-3.1build2 |
None known |
libtirpcUbuntu:26.10 |
All versions, plus listed versions 1.3.7-0.11.3.7+ds-1 |
None known |
ntirpcUbuntu:26.10 |
All versions, plus listed versions 6.3-47.2-2ubuntu1 |
None known |
libtirpcUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.6+ds-11.3.6+ds-1ubuntu11.3.7-0.1 |
None known |
ntirpcUbuntu:26.04:LTS |
All versions, plus listed versions 6.3-26.3-36.3-4 |
None known |
libtirpcopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.3.8-1.1 | 1.3.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts, products | CVE List, EUVD, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85231 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. No source names a fixed version.