{"id":"CVE-2026-53689","aliases":["AZL-90153","DEBIAN-CVE-2026-53689","EUVD-2026-36027","GHSA-379r-2p3h-m47v","MGASA-2026-0299","OESA-2026-2953","OESA-2026-2954","OESA-2026-3023","OESA-2026-3024","OESA-2026-3025","SUSE-SU-2026:22363-1","SUSE-SU-2026:22447-1","SUSE-SU-2026:2760-1","UBUNTU-CVE-2026-53689","USN-8464-1","openSUSE-SU-2026:11246-1","openSUSE-SU-2026:21055-1"],"status":"published","title":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer...","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00212,"percentile":0.11553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284"],"published":"2026-06-10T13:44:28Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libnfs","fixed_in":["5.0.2-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libnfs","fixed_in":["4.0.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnfs","fixed_in":["5.0.2-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnfs","fixed_in":["5.0.2-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libnfs","fixed_in":["6.0.2-2.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libnfs","fixed_in":["5.0.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libnfs","fixed_in":["5.0.2-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libnfs","fixed_in":["5.0.2-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libnfs","fixed_in":["5.0.2-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libnfs","fixed_in":["1.11.0-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libnfs","fixed_in":["1.11.0-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libnfs","fixed_in":["5.0.3-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libnfs","fixed_in":["5.0.3-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libnfs","fixed_in":["5.0.2-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libnfs","fixed_in":["1.11.0-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libnfs","fixed_in":["4.0.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libnfs","fixed_in":["5.0.2-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libnfs","fixed_in":["5.0.2-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libnfs","fixed_in":["5.0.2-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libnfs","fixed_in":["5.0.3-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1+deb12u1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1+deb13u1"}]}],"versions":["5.0.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1.1"}]}],"versions":["5.0.2-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-2.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.7-2","1.9.8-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-2","1.11.0-3","2.0.0-1~exp1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.0-2ubuntu1","4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1","4.0.0-1build1","4.0.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu0.24.04.1"}]}],"versions":["4.0.0-1build2","5.0.2-1","5.0.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu0.25.10.1"}]}],"versions":["5.0.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu1.1"}]}],"versions":["5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1","4.0.0-1build1","4.0.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu0.24.04.1"}]}],"versions":["4.0.0-1build2","5.0.2-1","5.0.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu0.25.10.1"}]}],"versions":["5.0.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1ubuntu1.1"}]}],"versions":["5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libnfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-160000.4.1"}]}]}],"products":[{"vendor":"sahlberg","product":"libnfs"}],"references":[{"url":"https://github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c729f","tags":["fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00031.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53689","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-379r-2p3h-m47v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53689.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53689","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0299.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35753","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8464-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2953","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2954","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3023","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3024","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3025","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268135","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53689","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622447-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262760-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-53689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53689","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57918","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-53689","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T13:44:28.272Z","modified":"2026-07-19T08:47:25.007Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-36027","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T13:44:28Z","modified":"2026-07-19T08:47:25Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:50.065723Z"}],"ghsa":[{"id":"GHSA-379r-2p3h-m47v","title":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer...","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T15:31:33Z","modified":"2026-07-19T09:31:36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:09:36.398204Z"}],"nvd":[{"id":"CVE-2026-53689","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T15:16:42.35Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-53689","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T13:44:28.272Z","modified":"2026-10-28T10:52:01.452466512Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53689","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T15:16:42.35Z","modified":"2026-10-27T09:47:34.96984308Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"OESA-2026-2953","title":"libnfs security update","description":"Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.\r\n\r\nSecurity Fix(es):\n\nlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)","status":"published","published":"2026-07-09T11:11:51Z","modified":"2026-08-18T01:21:16.757279616Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2954","title":"libnfs security update","description":"Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.\r\n\r\nSecurity Fix(es):\n\nlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)","status":"published","published":"2026-07-09T11:11:51Z","modified":"2026-08-18T01:21:16.753228564Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3023","title":"libnfs security update","description":"Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.\r\n\r\nSecurity Fix(es):\n\nlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:18.280965845Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3024","title":"libnfs security update","description":"Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.\r\n\r\nSecurity Fix(es):\n\nlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:18.280136222Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3025","title":"libnfs security update","description":"Package contains a library of functions for accessing NFSv2 and NFSv3 servers from user space. It provides a low-level,asynchronous RPC library for accessing NFS protocols, an asynchronous library with POSIX-like VFS functions,and a synchronous library with POSIX-like VFS functions.\r\n\r\nSecurity Fix(es):\n\nlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.(CVE-2026-53689)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:18.174946706Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-53689","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-06-23T22:00:08.002587824Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90153","title":"CVE-2026-53689 affecting package libnfs for versions less than 5.0.2-2","description":"libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.","status":"published","published":"2026-06-10T15:16:42Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0299","title":"Updated libnfs packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nlibnfs through 6.0.2 before 55c18ea does not validate a string size,\nleading to an integer overflow during a connection to a crafted NFS\nserver. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.\n(CVE-2026-53689)\n","status":"published","published":"2026-07-25T18:04:08Z","modified":"2026-07-25T18:15:05.279351571Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11246-1","title":"libnfs-devel-6.0.2-1.1 on GA media","description":"These are all security issues fixed in the libnfs-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.079853132Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21055-1","title":"Security update for libnfs","description":"This update for libnfs fixes the following issue\n\n- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).\n","status":"published","published":"2026-06-25T11:50:17Z","modified":"2026-06-30T18:24:29.390669855Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22363-1","title":"Security update for libnfs","description":"This update for libnfs fixes the following issue\n\n- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).\n","status":"published","published":"2026-06-25T11:50:53Z","modified":"2026-07-02T18:24:13.640314617Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22447-1","title":"Security update for libnfs","description":"This update for libnfs fixes the following issue\n\n- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).\n","status":"published","published":"2026-06-29T09:19:54Z","modified":"2026-07-04T18:24:19.017705562Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2760-1","title":"Security update for libnfs","description":"This update for libnfs fixes the following issue\n\n- CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).\n\nChanges for libnfs:\n\n- Add libnfs-CVE-2026-53689.patch: ZDR: check the string size for\n sanity (bsc#1268135 CVE-2026-53689).\n","status":"published","published":"2026-07-06T04:05:31Z","modified":"2026-07-07T08:30:04.946941982Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8464-1","title":"libnfs vulnerability","description":"It was discovered that LIBNFS incorrectly handled certain string sizes when\nconnecting to an NFS server. An attacker could use this issue to cause\nLIBNFS to crash, resulting in a denial of service, or possibly execute\narbitrary code.","status":"published","published":"2026-06-23T14:57:53Z","modified":"2026-06-23T22:14:21.9103571Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}