p PatchFirst

PatchFirst · Latest vulnerabilities

nfs-utils vulnerabilities

Vulnerabilities published for nfs-utils in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 11

  1. CVE-2026-89096

    Medium · CVSS 5.9EPSS 0.31%Fix available

    Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

    A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

    nfs-utilsOperating systems
    • Update to 1:3.1.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-89098

    Medium · CVSS 5.5EPSS 0.1%Fix available

    Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

    A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

    nfs-utilsOperating systems
    • Update to 1:3.1.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2025-12801

    Medium · CVSS 6.5EPSS 0.48%Fix available

    Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

    A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

    nfs-utilsOperating systems
    • Update to 1:2.8.6-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2019-3689

    Medium · CVSS 5.1EPSS 1.52%Fix available

    nfs-utils: root-owned files stored in insecure /var/lib/nfs directory

    The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.

    nfs-utilsOperating systems
    • Update to 1:1.3.4-3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2011-1749

    Not ratedEPSS 0.35%Fix available

    CVE-2011-1749

    The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

    nfs-utilsOperating systems
    • Update to 1:1.2.3-3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →