{"id":"CVE-2026-85231","kind":"vulnerability","aliases":["CVE-2026-85231"],"related":[],"title":"libtirpc: oversized RPCSEC_GSS requests exhaust memory and crash services","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.","summary":"libtirpc, the RPC library used by many Linux and Unix services, does not bound memory allocation for oversized wrapped data in RPCSEC_GSS integrity or privacy requests. An authenticated remote attacker can exhaust system memory, making the RPC service unstable or terminating it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kerberos","linux","nfs","self-hosted"],"not_affected_if":["no-rpc-services","no-rpcsec-gss"],"how_to_check":"- Check the installed libtirpc version with `rpm -q libtirpc` or `dpkg -s libtirpc3`\n- Check whether an RPC service uses RPCSEC_GSS with integrity or privacy, for example in `/etc/exports` or the NFS/gssd configuration\n- unknown for the vulnerable version range","fix":"- Update libtirpc to the patched version from your distribution's security advisory (version unknown from the sources)\n- Restart affected RPC services after the update","status":"open","published_at":"2026-10-16T19:17:44+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:45+00:00","updated_at":"2026-10-25T03:57:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:57:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update libtirpc to the patched version from your distribution's security advisory (version unknown from the sources)\n- Restart affected RPC services after the update","reach":"network","title":"libtirpc: oversized RPCSEC_GSS requests exhaust memory and crash services","impact":"medium","summary":"libtirpc, the RPC library used by many Linux and Unix services, does not bound memory allocation for oversized wrapped data in RPCSEC_GSS integrity or privacy requests. An authenticated remote attacker can exhaust system memory, making the RPC service unstable or terminating it.","category":"infrastructure","nicknames":[],"who_cares":["linux","nfs","kerberos","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Remote memory exhaustion crashes or destabilizes the RPC service","analyst_note":"Find the patched libtirpc version and affected distributions from the NVD entry and vendor advisories.","how_to_check":"- Check the installed libtirpc version with `rpm -q libtirpc` or `dpkg -s libtirpc3`\n- Check whether an RPC service uses RPCSEC_GSS with integrity or privacy, for example in `/etc/exports` or the NFS/gssd configuration\n- unknown for the vulnerable version range","needs_analyst":true,"not_affected_if":["no-rpcsec-gss","no-rpc-services"],"who_is_affected":"Systems running an RPC service that is configured with RPCSEC_GSS integrity or privacy, such as Kerberos-secured NFS, are exposed because the flaw sits in the wrapped-data parsing path. Hosts that run no RPC services, or only use RPCSEC_GSS with authentication only, can skip it. The sources do not name the vulnerable version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3351,"output_tokens":661,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85231':13A,16A 'alloc':39B,114C 'attack':54B,75C 'authent':52B,73C 'becom':131C 'bound':37B 'call':91C,99C 'caus':127C 'configur':93C 'could':76C 'crash':9A 'cve':11A,14A 'data':43B,84C 'denial':118C 'dos':121C 'exhaust':6A,56B,123C 'exploit':77C 'flaw':67C 'found':69C 'generic':102C 'gss':4A,46B,96C 'host':23B 'infrastructur':17B 'integr':47B,105C 'kerbero':18B 'lead':110C 'librari':27B 'libtirpc':1A,24B,71C 'linux':19B,31B 'make':59B 'mani':30B 'memori':7A,38B,58B,113C 'nfs':20B 'overs':2A,41B,82C 'privaci':49B,107C 'procedur':90C,98C 'remot':53B,74C,89C,97C 'request':5A,50B,85C 'resourc':125C 'result':115C 'rpc':26B,61B,88C 'rpcsec':3A,45B,95C 'secur':101C,103C 'security-gener':100C 'self':22B 'self-host':21B 'send':81C 'servic':10A,34B,62B,92C,104C,120C,129C 'system':57B,124C 'termin':65B,134C 'unbound':112C 'unix':33B 'unstabl':63B,132C 'use':28B 'vulner':79C 'wrap':42B,83C","nicknames":[],"mitigations":[],"who_affected":"Systems running an RPC service that is configured with RPCSEC_GSS integrity or privacy, such as Kerberos-secured NFS, are exposed because the flaw sits in the wrapped-data parsing path. Hosts that run no RPC services, or only use RPCSEC_GSS with authentication only, can skip it. The sources do not name the vulnerable version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","severity":null,"published_at":"2026-10-16T19:17:44+00:00","modified_at":"2026-10-16T20:18:12+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}