{"id":"CVE-2026-85977","kind":"vulnerability","aliases":["CVE-2026-85977"],"related":[],"title":"libtirpc: crafted PMAPPROC_DUMP replies exhaust client memory and CPU","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.","summary":"libtirpc's pmap_getmaps() decodes PMAPPROC_DUMP replies without a bound, so a malicious server can make the client allocate excessive memory and CPU. The result is a denial of service that crashes or stalls the calling client process.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libtirpc","linux","nfs-clients","rpc"],"not_affected_if":["no-pmap-getmaps-use","trusted-hosts-only"],"how_to_check":"- `unknown`","fix":"- unknown","status":"open","published_at":"2026-10-16T19:17:44+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:57+00:00","updated_at":"2026-10-25T04:26:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:26:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"libtirpc: crafted PMAPPROC_DUMP replies exhaust client memory and CPU","impact":"low","summary":"libtirpc's pmap_getmaps() decodes PMAPPROC_DUMP replies without a bound, so a malicious server can make the client allocate excessive memory and CPU. The result is a denial of service that crashes or stalls the calling client process.","category":"infrastructure","nicknames":[],"who_cares":["linux","libtirpc","rpc","nfs-clients"],"confidence":0.6,"needs_auth":"no","worst_case":"Client process exhausts memory and CPU, causing denial of service","analyst_note":"Check the NVD entry and upstream libtirpc advisory for affected and fixed versions and distro patch status.","how_to_check":"- `unknown`","needs_analyst":true,"not_affected_if":["no-pmap-getmaps-use","trusted-hosts-only"],"who_is_affected":"Only client applications that call pmap_getmaps() and talk to an attacker-controlled portmapper or RPC host are exposed. Servers and clients that do not use pmap_getmaps() against untrusted hosts are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3327,"output_tokens":461,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85977':13A,16A 'alloc':43B,109C 'applic':86C 'attack':71C,96C 'attacker-control':95C 'bound':34B 'call':60B 'caus':110C 'client':7A,22B,42B,61B,85C,112C 'control':97C 'cpu':10A,47B,108C 'craft':2A,79C 'crash':56B 'cve':11A,14A 'decod':28B,101C 'denial':52B,117C 'dos':120C 'due':121C 'dump':4A,30B,81C 'excess':44B,105C 'exhaust':6A,124C 'experi':115C 'exploit':73C 'flaw':64C 'found':66C 'function':92C 'getmap':27B,91C 'host':98C 'infrastructur':17B 'lead':103C 'libtirpc':1A,18B,24B,68C 'linux':19B 'make':40B 'malici':37B 'memori':8A,45B,106C 'nfs':21B 'nfs-client':20B 'pmap':26B,90C 'pmapproc':3A,29B,80C 'process':62B,113C 'remot':70C 'repli':5A,31B,82C 'resourc':123C 'result':49B 'rpc':23B 'send':77C 'server':38B 'servic':54B,119C 'special':78C 'stall':58B 'unbound':100C 'use':88C 'vulner':75C 'without':32B","nicknames":[],"mitigations":[],"who_affected":"Only client applications that call pmap_getmaps() and talk to an attacker-controlled portmapper or RPC host are exposed. Servers and clients that do not use pmap_getmaps() against untrusted hosts are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","severity":null,"published_at":"2026-10-16T19:17:44+00:00","modified_at":"2026-10-19T15:17:08+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}