p PatchFirst

CVE-2026-85231

CVE-2026-85231 · Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.

CVSS 6.5 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat hardened images

    No fix published

  • red hat openshift container platform 4

    No fix published

  • libtirpc Debian:12

    Versions
    • 1.3.3+ds-1
    • 1.3.4+ds-1
    • 1.3.4+ds-1.1
    • 1.3.4+ds-1.1~exp1
    • 1.3.4+ds-1.1~exp2
    • 1.3.4+ds-1.2
    • 1.3.4+ds-1.3
    • 1.3.6+ds-1
    • 1.3.7+ds-1
    • 1.3.7-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Debian:13

    Versions
    • 1.3.6+ds-1
    • 1.3.7+ds-1
    • 1.3.7-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Debian:14

    Versions
    • 1.3.6+ds-1
    • 1.3.7+ds-1
    • 1.3.7-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:14.04:LTS

    Versions
    • 0.2.2-5ubuntu1
    • 0.2.2-5ubuntu2
    • 0.2.2-5ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:16.04:LTS

    Versions
    • 0.2.5-1
    • 0.2.5-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:16.04:LTS

    Versions
    • 1.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:18.04:LTS

    Versions
    • 0.2.5-1.2
    • 0.2.5-1.2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:18.04:LTS

    Versions
    • 1.4.4-1
    • 1.5.3-1
    • 1.6.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:20.04:LTS

    Versions
    • 1.1.4-0.4
    • 1.1.4-1
    • 1.2.5-1
    • 1.2.5-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:20.04:LTS

    Versions
    • 1.7.4-2
    • 3.0-0ubuntu1
    • 3.0-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:22.04:LTS

    Versions
    • 1.3.2-2
    • 1.3.2-2build1
    • 1.3.2-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:22.04:LTS

    Versions
    • 3.4-2build1
    • 3.4-2build2
    • 3.5-1
    • 3.5-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:24.04:LTS

    Versions
    • 1.3.3+ds-1
    • 1.3.4+ds-1
    • 1.3.4+ds-1build1
    • 1.3.4+ds-1.1
    • 1.3.4+ds-1.1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:24.04:LTS

    Versions
    • 4.3-2
    • 4.3-3
    • 4.3-3.1
    • 4.3-3.1build1
    • 4.3-3.1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:26.10

    Versions
    • 1.3.7-0.1
    • 1.3.7+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ntirpc Ubuntu:26.10

    Versions
    • 6.3-4
    • 7.2-2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libtirpc Ubuntu:26.04:LTS

    Versions
    • 1.3.6+ds-1
    • 1.3.6+ds-1ubuntu1
    • 1.3.7-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →