CVE-2026-85977

Awaiting Analysis Awaiting Analysis - Queue

Remote DoS in libtirpc via PMAPPROC_DUMP

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-85977

EUVD

EUVD-2026-103020

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 6 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat Hardened Images *
Red	Hat	Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1050	The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

Attack-Flow Graph

Executive Summary

This vulnerability is in libtirpc where a remote attacker sends specially crafted PMAPPROC_DUMP replies to a client using pmap_getmaps(). The crafted data causes unbounded decoding, leading to excessive memory and CPU usage. This results in a Denial of Service (DoS) due to resource exhaustion.

Detection Guidance

This vulnerability involves unbounded decoding in libtirpc when processing PMAPPROC_DUMP replies. To detect it, monitor for unusual memory or CPU usage spikes in client applications using pmap_getmaps() against untrusted hosts. Check for network traffic involving portmap or rpcbind services. Use tools like netstat, ss, or tcpdump to inspect RPC-related connections and payloads.

Impact Analysis

If you use a client application that relies on pmap_getmaps() against an untrusted host, an attacker could trigger this flaw. This may cause your application to consume excessive system resources, leading to crashes or degraded performance.

Compliance Impact

This vulnerability causes Denial of Service (DoS) through resource exhaustion, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for security and resilience. For HIPAA, it could affect the availability of systems processing protected health information, potentially compromising the Security Rule's integrity requirements.

Mitigation Strategies

Update libtirpc to the latest patched version to prevent the DoS condition from being triggered by malicious PMAPPROC_DUMP replies.

Hi! I’m here to help you understand CVE-2026-85977. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70