Description
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.
Published: 2026-10-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Mitigation
AI Analysis

Impact

A flaw in libtirpc enables a remote attacker to send specially crafted PMAPPROC_DUMP replies to a client that uses pmap_getmaps(). The unbounded decoding of the reply causes the client to allocate excessive memory and CPU, leading to DoS due to resource exhaustion. The weakness is identified as CWE-1050.

Affected Systems

Affected are multiple Red Hat products, including Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw exists in libtirpc used by these distributions and platform versions as listed by the CNA.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS score means exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker can target any client application exposing pmap_getmaps() to the network; therefore, remote exploitation is possible if the client can reach an attacker‑controlled portmapper.

Generated by OpenCVE AI on October 16, 2026 at 19:15 UTC.

Remediation

Vendor Workaround

To mitigate this issue, avoid configuring applications that use `pmap_getmaps()` to query untrusted or attacker-controlled portmapper services. If such functionality is essential, restrict network access for services utilizing `pmap_getmaps()` to only trusted hosts via firewall rules. Additionally, consider isolating client applications that call `pmap_getmaps()` into constrained environments to limit the impact of potential resource exhaustion.

OpenCVE Recommended Actions

  • Disable or remove pmap_getmaps() calls in applications that connect to untrusted hosts.
  • If pmap_getmaps() is required, configure firewall rules to restrict network access for services using it to only trusted hosts.
  • Run affected client applications in constrained or containerized environments to limit resource impact.

Generated by OpenCVE AI on October 16, 2026 at 19:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9		 cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:openshift:5
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Libtirpc Project
Libtirpc Project libtirpc
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Libtirpc Project
Libtirpc Project libtirpc
Redhat hardened Images
Redhat openshift Container Platform

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
References

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.
Title Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-1050
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Libtirpc Project Libtirpc
Redhat Enterprise Linux Hardened Images Hummingbird Openshift Openshift Container Platform Rhel Els
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-06T01:08:24.629Z

Reserved: 2026-09-04T18:43:38.572Z

Link: CVE-2026-85977

cve-icon Vulnrichment

Updated: 2026-10-19T14:21:21.576Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T19:17:44.430

Modified: 2026-11-06T01:18:00.250

Link: CVE-2026-85977

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-16T15:03:06Z

Links: CVE-2026-85977 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:22:14Z

Weaknesses
  • CWE-1050

    Excessive Platform Resource Consumption within a Loop