{"id":"CVE-2026-89096","kind":"vulnerability","aliases":["CVE-2026-89096"],"related":[],"title":"nfs-utils: rpc.statd memory leak lets remote users exhaust resources","description":"A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.","summary":"nfs-utils rpc.statd leaks memory during callback processing when it receives repeated state notification requests. A remote unauthenticated attacker can grow memory use until the service degrades or crashes, causing denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","nfs-servers","nfs-utils","self-hosted"],"not_affected_if":["no-network-exposure","statd-disabled"],"how_to_check":"- `rpm -q nfs-utils` or `dpkg -s nfs-utils` to read the installed version\n- Check whether rpc.statd is running and reachable from the network, for example with `rpcinfo -p` and `ss -lntup | grep -i statd`\n- Fixed version: unknown","fix":"- Update nfs-utils to a fixed release from your distribution; the fixed version is unknown from the sources\n- Block untrusted network access to rpc.statd until patched, for example with a firewall rule on the statd port","status":"open","published_at":"2026-10-16T23:17:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:09:54+00:00","updated_at":"2026-10-25T04:09:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:09:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update nfs-utils to a fixed release from your distribution; the fixed version is unknown from the sources\n- Block untrusted network access to rpc.statd until patched, for example with a firewall rule on the statd port","reach":"network","title":"nfs-utils: rpc.statd memory leak lets remote users exhaust resources","impact":"low","summary":"nfs-utils rpc.statd leaks memory during callback processing when it receives repeated state notification requests. A remote unauthenticated attacker can grow memory use until the service degrades or crashes, causing denial of service.","category":"infrastructure","nicknames":[],"who_cares":["nfs-utils","linux","self-hosted","nfs-servers"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker degrades or crashes the rpc.statd service","analyst_note":"Find the fixed nfs-utils version and distribution advisories for CVE-2026-89096; the NVD entry alone gives no version or check.","how_to_check":"- `rpm -q nfs-utils` or `dpkg -s nfs-utils` to read the installed version\n- Check whether rpc.statd is running and reachable from the network, for example with `rpcinfo -p` and `ss -lntup | grep -i statd`\n- Fixed version: unknown","needs_analyst":true,"not_affected_if":["statd-disabled","no-network-exposure"],"who_is_affected":"Systems running nfs-utils with rpc.statd exposed to a network that untrusted parties can reach. The sources describe a remote, unauthenticated trigger, so hosts that only serve NFS on a closed internal network or do not run rpc.statd are less exposed. Machines where statd is disabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3319,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-89096':14A,17A 'alloc':100C 'attack':48B,74C 'callback':36B,102C 'caus':59B,116C 'continu':106C 'crash':58B,122C 'cve':12A,15A 'degrad':56B,120C 'denial':60B,78C 'dos':81C 'eventu':115C 'exhaust':10A,112C 'expos':90C 'fail':95C 'flaw':64C 'found':66C 'grow':50B 'growth':108C 'host':28B 'infrastructur':18B 'lead':104C 'leak':6A,33B 'let':7A 'linux':19B 'memori':5A,34B,51B,99C,107C 'nfs':2A,21B,24B,30B,69C 'nfs-server':20B 'nfs-util':1A,23B,29B,68C 'notif':43B,86C 'process':37B,103C 'proper':97C 'receiv':40B 'releas':98C 'remot':8A,46B,73C 'repeat':41B,84C 'request':44B,87C,110C 'resourc':11A,114C 'rpc.statd':4A,32B,91C 'self':27B 'self-host':26B 'send':83C 'server':22B 'servic':55B,62B,80C,92C,94C,118C 'state':42B,85C 'sustain':109C 'system':113C 'trigger':76C 'unauthent':47B,72C 'use':52B 'user':9A 'util':3A,25B,31B,70C","nicknames":[],"mitigations":[],"who_affected":"Systems running nfs-utils with rpc.statd exposed to a network that untrusted parties can reach. The sources describe a remote, unauthenticated trigger, so hosts that only serve NFS on a closed internal network or do not run rpc.statd are less exposed. Machines where statd is disabled can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89096","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89096","severity":null,"published_at":"2026-10-16T23:17:02+00:00","modified_at":"2026-10-19T21:03:27+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}