An authenticated remote attacker can send oversized wrapped data requests to an RPC service configured with RPCSEC_GSS, causing libtirpc to perform an unbounded memory allocation during decoding. This results in a denial of service as the service exhausts system resources, becomes unstable or terminates. The flaw resides in libtirpc's handling of RPCSEC_GSS requests and requires an authenticated RPC session and the ability to reach the service from an external network.

Known affected distributions include Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. All of these use libtirpc as part of the RPC server stack and are vulnerable when RPCSEC_GSS integrity or privacy modes are enabled.

The CVSS score of 6.5 marks it as a Moderate severity issue. EPSS data is unavailable, so current exploitation probability is unclear; no public exploits are listed in CISA KEV. The likely attack vector is a remote authenticated connection to an RPC service that has RPCSEC_GSS enabled, which is often exposed to external networks. Exploitation requires the attacker to authenticate to the RPC service and supply a specially crafted, overly large wrapped data packet before the server decodes it, leading to uncontrolled memory allocation.