CVE-2026-53689
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer...
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
CVE-2026-53689- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
EUVDEUVD-2026-36027
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
EUVD-2026-36027- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-379r-2p3h-m47v
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer...
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
GHSA-379r-2p3h-m47v- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
NVD
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
CVE-2026-53689- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
OSV
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
CVE-2026-53689- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-53689
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
DEBIAN-CVE-2026-53689- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Show 14 moreShow less
OSVOESA-2026-2953
libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.
Security Fix(es):
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)
- Record
OESA-2026-2953- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVOESA-2026-2954
libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.
Security Fix(es):
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)
- Record
OESA-2026-2954- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVOESA-2026-3023
libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.
Security Fix(es):
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)
- Record
OESA-2026-3023- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVOESA-2026-3024
libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.
Security Fix(es):
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)
- Record
OESA-2026-3024- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVOESA-2026-3025
libnfs security update
Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.
Security Fix(es):
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)
- Record
OESA-2026-3025- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-53689
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
UBUNTU-CVE-2026-53689- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVAZL-90153 No score
CVE-2026-53689 affecting package libnfs for versions less than 5.0.2-2
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
- Record
AZL-90153- Updated
- 2026-11-05
OSVMGASA-2026-0299 No score
Updated libnfs packages fix a security vulnerability
The updated packages fix a security vulnerability: libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c. (CVE-2026-53689)
- Record
MGASA-2026-0299- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11246-1 No score
libnfs-devel-6.0.2-1.1 on GA media
These are all security issues fixed in the libnfs-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11246-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21055-1 No score
Security update for libnfs
This update for libnfs fixes the following issue
- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).
- Record
openSUSE-SU-2026:21055-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22363-1 No score
Security update for libnfs
This update for libnfs fixes the following issue
- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).
- Record
SUSE-SU-2026:22363-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22447-1 No score
Security update for libnfs
This update for libnfs fixes the following issue
- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).
- Record
SUSE-SU-2026:22447-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2760-1 No score
Security update for libnfs
This update for libnfs fixes the following issue
- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).
Changes for libnfs:
- Add libnfs-CVE-2026-53689.patch: ZDR: check the string size for sanity (bsc#1268135 CVE-2026-53689).
- Record
SUSE-SU-2026:2760-1- Updated
- 2026-11-02
OSVUSN-8464-1 No score
libnfs vulnerability
It was discovered that LIBNFS incorrectly handled certain string sizes when connecting to an NFS server. An attacker could use this issue to cause LIBNFS to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-8464-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnfsAzure Linux:3 |
before 5.0.2-2 | 5.0.2-2 |
libnfsDebian:12 |
before 4.0.0-1+deb12u1, plus listed versions 4.0.0-1 |
4.0.0-1+deb12u1 |
libnfsDebian:13 |
before 5.0.2-1+deb13u1, plus listed versions 5.0.2-1 |
5.0.2-1+deb13u1 |
libnfsDebian:14 |
before 5.0.2-1.1, plus listed versions 5.0.2-1 |
5.0.2-1.1 |
libnfsMageia:10 |
before 6.0.2-2.1.mga10 | 6.0.2-2.1.mga10 |
libnfsMageia:9 |
before 5.0.2-1.1.mga9 | 5.0.2-1.1.mga9 |
libnfsopenEuler:24.03-LTS-SP3 |
before 5.0.2-3.oe2403sp3 | 5.0.2-3.oe2403sp3 |
libnfsopenEuler:24.03-LTS-SP1 |
before 5.0.2-3.oe2403sp1 | 5.0.2-3.oe2403sp1 |
libnfsopenEuler:24.03-LTS-SP4 |
before 5.0.2-3.oe2403sp4 | 5.0.2-3.oe2403sp4 |
libnfsopenEuler:20.03-LTS-SP4 |
before 1.11.0-5.oe2003sp4 | 1.11.0-5.oe2003sp4 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libnfsopenEuler:22.03-LTS-SP4 |
before 1.11.0-5.oe2203sp4 | 1.11.0-5.oe2203sp4 |
libnfsSUSE:Linux Enterprise Server 16.0 |
before 5.0.3-160000.4.1 | 5.0.3-160000.4.1 |
libnfsSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 5.0.3-160000.4.1 | 5.0.3-160000.4.1 |
libnfsSUSE:Linux Micro 6.1 |
before 5.0.2-slfo.1.1_2.1 | 5.0.2-slfo.1.1_2.1 |
libnfsSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 1.11.0-150000.3.3.1 | 1.11.0-150000.3.3.1 |
libnfsUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.7-21.9.8-1 |
None known |
libnfsUbuntu:18.04:LTS |
All versions, plus listed versions 1.11.0-21.11.0-32.0.0-1~exp1 |
None known |
libnfsUbuntu:20.04:LTS |
All versions, plus listed versions 3.0.0-2ubuntu14.0.0-1 |
None known |
libnfsUbuntu:22.04:LTS |
before 4.0.0-1ubuntu0.1, plus listed versions 4.0.0-14.0.0-1build14.0.0-1build2 |
4.0.0-1ubuntu0.1 |
libnfsUbuntu:24.04:LTS |
before 5.0.2-1ubuntu0.24.04.1, plus listed versions 4.0.0-1build25.0.2-15.0.2-1build1 |
5.0.2-1ubuntu0.24.04.1 |
libnfsUbuntu:25.10 |
before 5.0.2-1ubuntu0.25.10.1, plus listed versions 5.0.2-1build1 |
5.0.2-1ubuntu0.25.10.1 |
libnfsUbuntu:26.04:LTS |
before 5.0.2-1ubuntu1.1, plus listed versions 5.0.2-1build15.0.2-1build25.0.2-1ubuntu1 |
5.0.2-1ubuntu1.1 |
libnfsopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 6.0.2-1.1 | 6.0.2-1.1 |
libnfsopenSUSE:Leap 16.0 |
before 5.0.3-160000.4.1 | 5.0.3-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53689 is a high vulnerability (CVSS 7.1) in Sahlberg Libnfs, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in libnfs 5.0.2-2.
References
github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c729f
lists.debian.org/debian-lts-announce/2026/07/msg00031.html
nvd.nist.gov/vuln/detail/CVE-2026-53689
security-tracker.debian.org/tracker/CVE-2026-53689
Show 16 moreShow less
advisories.mageia.org/MGASA-2026-0299.html
bugs.mageia.org/show_bug.cgi?id=35753
ubuntu.com/security/notices/USN-8464-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2953
suse.com/support/update/announcement/2026/suse-su-202622363-1
bugzilla.suse.com/1268135
cve.org/CVERecord?id=CVE-2026-53689