Every CVE Search/ Get API key

CVE-2026-89096

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

5.9 MediumFix available

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.31%Unchanged since Oct 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
CVE-2026-89096
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-06
EUVDEUVD-2026-103204 5.9

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
EUVD-2026-103204
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-vm5m-6m89-c34w 5.9

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service...

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
GHSA-vm5m-6m89-c34w
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-02
NVD 5.9

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
CVE-2026-89096
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-06
OSVBELL-CVE-2026-89096 5.9
Record
BELL-CVE-2026-89096
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-89096 5.9

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
DEBIAN-CVE-2026-89096
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-89096 5.9

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Record
UBUNTU-CVE-2026-89096
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nfs-utils
Alpaquita:23
 2.6.2-r0 and later None known
nfs-utils
Alpaquita:25
 2.6.4-r4 and later None known
nfs-utils
Alpaquita:stream
 2.6.2-r0 and later None known
nfs-utils
Debian:12
 All versions, plus listed versions
1:2.6.2-41:2.6.2-4+deb12u11:2.6.3-11:2.6.3-1~exp11:2.6.3-2
Show 30 moreShow less
1:2.6.3-31:2.6.3-4~exp11:2.6.4-11:2.6.4-1~exp11:2.6.4-21:2.6.4-31:2.6.4-41:2.6.4-51:2.6.4-61:2.7.1-11:2.7.1-1~exp11:2.7.1-21:2.7.1-31:2.8.1-11:2.8.1-1~exp11:2.8.1-21:2.8.2-11:2.8.2-21:2.8.2-2~exp11:2.8.2-31:2.8.3-11:2.8.3-1~exp11:2.8.4-11:2.8.4-21:2.8.5-11:2.8.6-11:2.8.7-11:2.9.1-11:2.9.2-11:3.1.1-1
 None known
nfs-utils
Debian:13
 All versions, plus listed versions
1:2.8.3-11:2.8.4-11:2.8.4-21:2.8.5-11:2.8.6-1
Show 4 moreShow less
1:2.8.7-11:2.9.1-11:2.9.2-11:3.1.1-1
 None known
nfs-utils
Debian:14
 before 1:3.1.1-1, plus listed versions
1:2.8.3-11:2.8.4-11:2.8.4-21:2.8.5-11:2.8.6-11:2.8.7-11:2.9.1-11:2.9.2-1
1:3.1.1-1
nfs-utils
Ubuntu:14.04:LTS
 All versions, plus listed versions
1:1.2.8-2ubuntu21:1.2.8-4ubuntu11:1.2.8-5ubuntu11:1.2.8-6ubuntu11:1.2.8-6ubuntu1.11:1.2.8-6ubuntu1.2
 None known
nfs-utils
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:1.2.8-9ubuntu101:1.2.8-9ubuntu111:1.2.8-9ubuntu121:1.2.8-9ubuntu12.11:1.2.8-9ubuntu12.21:1.2.8-9ubuntu12.3
 None known
nfs-utils
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:1.3.4-2.1ubuntu21:1.3.4-2.1ubuntu41:1.3.4-2.1ubuntu51:1.3.4-2.1ubuntu5.11:1.3.4-2.1ubuntu5.21:1.3.4-2.1ubuntu5.31:1.3.4-2.1ubuntu5.5
 None known
nfs-utils
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:1.3.4-2.5ubuntu21:1.3.4-2.5ubuntu31:1.3.4-2.5ubuntu3.11:1.3.4-2.5ubuntu3.31:1.3.4-2.5ubuntu3.41:1.3.4-2.5ubuntu3.51:1.3.4-2.5ubuntu3.61:1.3.4-2.5ubuntu3.7
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
nfs-utils
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:1.3.4-6ubuntu11:2.6.1-1~exp1ubuntu11:2.6.1-1ubuntu11:2.6.1-1ubuntu1.11:2.6.1-1ubuntu1.2
 None known
nfs-utils
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:2.6.3-3ubuntu11:2.6.4-3ubuntu31:2.6.4-3ubuntu41:2.6.4-3ubuntu51:2.6.4-3ubuntu5.1
 None known
nfs-utils
Ubuntu:26.10
 All versions, plus listed versions
1:2.8.5-1ubuntu11:2.9.1-1ubuntu1
 None known
nfs-utils
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:2.8.3-1ubuntu31:2.8.4-1ubuntu11:2.8.5-1ubuntu1
 None known

History

History
RecordedChangedSources
productsCVE List
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-89096 is a medium vulnerability (CVSS 5.9) in Red Hat Enterprise Linux 10, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in nfs-utils 1:3.1.1-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open