CVE-2026-85231 — Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) serv…
Published: 2026-10-16 · CVSS: 6.5 · CVSS 3.1
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7