CVE catalog

CVE-2026-85977

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against

[CVE catalog]

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Oct 16, 2026, 3:03:06 PM UTC
Updated: Oct 16, 2026, 7:23:18 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 25, 2026

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libtirpc	sid	`1.3.7+ds-1`	vulnerable
Debian	libtirpc	forky	`1.3.7+ds-1`	vulnerable
Debian	libtirpc	trixie	`1.3.6+ds-1`	vulnerable
Debian	libtirpc	bookworm	`1.3.3+ds-1`	vulnerable
Ubuntu	libtirpc	14.04	`0.2.2-5ubuntu1`	vulnerable
Ubuntu	libtirpc	14.04	`0.2.2-5ubuntu2`	vulnerable
Ubuntu	libtirpc	14.04	`0.2.2-5ubuntu2.1`	vulnerable
Ubuntu	libtirpc	16.04	`0.2.5-1`	vulnerable
Ubuntu	libtirpc	16.04	`0.2.5-1ubuntu0.1`	vulnerable
Ubuntu	ntirpc	16.04	`1.3.1-1`	vulnerable
Ubuntu	libtirpc	18.04	`0.2.5-1.2`	vulnerable
Ubuntu	libtirpc	18.04	`0.2.5-1.2ubuntu0.1`	vulnerable
Ubuntu	ntirpc	18.04	`1.4.4-1`	vulnerable
Ubuntu	ntirpc	18.04	`1.5.3-1`	vulnerable
Ubuntu	ntirpc	18.04	`1.6.1-1`	vulnerable
Ubuntu	libtirpc	20.04	`1.1.4-0.4`	vulnerable
Ubuntu	libtirpc	20.04	`1.1.4-1`	vulnerable
Ubuntu	libtirpc	20.04	`1.2.5-1`	vulnerable
Ubuntu	libtirpc	20.04	`1.2.5-1ubuntu0.1`	vulnerable
Ubuntu	ntirpc	20.04	`1.7.4-2`	vulnerable
Ubuntu	ntirpc	20.04	`3.0-0ubuntu1`	vulnerable
Ubuntu	ntirpc	20.04	`3.0-0ubuntu2`	vulnerable
Ubuntu	libtirpc	22.04	`1.3.2-2`	vulnerable
Ubuntu	libtirpc	22.04	`1.3.2-2build1`	vulnerable
Ubuntu	libtirpc	22.04	`1.3.2-2ubuntu0.1`	vulnerable
Ubuntu	ntirpc	22.04	`3.4-2build1`	vulnerable
Ubuntu	ntirpc	22.04	`3.4-2build2`	vulnerable
Ubuntu	ntirpc	22.04	`3.5-1`	vulnerable
Ubuntu	ntirpc	22.04	`3.5-2`	vulnerable
Ubuntu	libtirpc	24.04	`1.3.3+ds-1`	vulnerable
Ubuntu	libtirpc	24.04	`1.3.4+ds-1`	vulnerable
Ubuntu	libtirpc	24.04	`1.3.4+ds-1build1`	vulnerable
Ubuntu	libtirpc	24.04	`1.3.4+ds-1.1`	vulnerable
Ubuntu	libtirpc	24.04	`1.3.4+ds-1.1build1`	vulnerable
Ubuntu	ntirpc	24.04	`4.3-2`	vulnerable
Ubuntu	ntirpc	24.04	`4.3-3`	vulnerable
Ubuntu	ntirpc	24.04	`4.3-3.1`	vulnerable
Ubuntu	ntirpc	24.04	`4.3-3.1build1`	vulnerable
Ubuntu	ntirpc	24.04	`4.3-3.1build2`	vulnerable
Ubuntu	libtirpc	26.10	`1.3.7-0.1`	vulnerable
Ubuntu	libtirpc	26.10	`1.3.7+ds-1`	vulnerable
Ubuntu	ntirpc	26.10	`6.3-4`	vulnerable
Ubuntu	ntirpc	26.10	`7.2-2ubuntu1`	vulnerable
Ubuntu	libtirpc	26.04	`1.3.6+ds-1`	vulnerable
Ubuntu	libtirpc	26.04	`1.3.6+ds-1ubuntu1`	vulnerable
Ubuntu	libtirpc	26.04	`1.3.7-0.1`	vulnerable
Ubuntu	ntirpc	26.04	`6.3-2`	vulnerable
Ubuntu	ntirpc	26.04	`6.3-3`	vulnerable
Ubuntu	ntirpc	26.04	`6.3-4`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libtirpc	source	sid	`(unfixed)`	not yet assigned	Not reported	[1151102]
Debian	libtirpc	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151102]
Debian	libtirpc	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151102]
Debian	libtirpc	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151102]

[Debian bug #1151102]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libtirpc3]Affected
Source package: [libtirpc]
Details (2)
- 1.3.3+ds-1 · amd64 · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12
- 1.3.3+ds-1 · arm64 · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12
[libtirpc-common]Affected
Source package: [libtirpc]
Details (2)
- 1.3.3+ds-1 · all · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12
- 1.3.3+ds-1 · all · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12
[libtirpc-dev]Affected
Source package: [libtirpc]
Details (2)
- 1.3.3+ds-1 · amd64 · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12
- 1.3.3+ds-1 · arm64 · bookworm
  Affected
  nvd · libtirpc · debian · bookworm; nvd · libtirpc · debian · 12

[Debian 13 (Trixie)]

[libtirpc3t64]Affected
Source package: [libtirpc]
Details (2)
- 1.3.6+ds-1 · amd64 · trixie
  Affected
  nvd · libtirpc · debian · 13
- 1.3.6+ds-1 · arm64 · trixie
  Affected
  nvd · libtirpc · debian · 13
[libtirpc-common]Affected
Source package: [libtirpc]
Details (2)
- 1.3.6+ds-1 · all · trixie
  Affected
  nvd · libtirpc · debian · 13
- 1.3.6+ds-1 · all · trixie
  Affected
  nvd · libtirpc · debian · 13
[libtirpc-dev]Affected
Source package: [libtirpc]
Details (2)
- 1.3.6+ds-1 · amd64 · trixie
  Affected
  nvd · libtirpc · debian · 13
- 1.3.6+ds-1 · arm64 · trixie
  Affected
  nvd · libtirpc · debian · 13

Observed: Oct 25, 2026, 2:57:20 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]