Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85231— Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 libtirpc 中发现了一个安全缺陷。已认证的远程攻击者可以通过向配置了 RPCSEC_GSS（远程过程调用安全 - 通用安全服务）完整性或隐私保护的 RPC（远程过程调用）服务发送超大的封装数据请求，来利用该漏洞。这可能导致无限制的内存分配，从而耗尽系统资源，引发拒绝服务（DoS）攻击，导致服务变得不稳定或终止。

CVSS 6.5 · Medium EPSS 0.30% · P21

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 8

VendorProduct Version RangeStatus
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 6 any affected
Red Hat Red Hat Enterprise Linux 7 any affected
Red Hat Red Hat Enterprise Linux 8 any affected
Red Hat Red Hat Enterprise Linux 9 any affected
Red Hat Red Hat Hardened Images any affected
Red Hat Red Hat OpenShift Container Platform 4 any affected
any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85231

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-85231

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85231

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85231 (2)

Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total

CVE-2026-104715 7.8 HIGH Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by
CVE-2026-105958 7.5 HIGH Spice-server: spice: heap oob read/write via unchecked migration data offsets
CVE-2026-105959 7.5 HIGH Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati
CVE-2026-62439 7.0 HIGH Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow
CVE-2026-89085 6.6 MEDIUM Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
CVE-2026-111802 6.6 MEDIUM Nautilus: nautilus: arbitrary file deletion via trash symlink
CVE-2026-62438 6.1 MEDIUM Gimp: gimp: paa integer overflow out-of-bounds read
CVE-2026-111555 6.0 MEDIUM Luksmeta: missing slot-range validation permits out-of-gap device i/o
CVE-2026-89096 5.9 MEDIUM Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
CVE-2026-89088 5.5 MEDIUM Parted: parted: denial of service via heap buffer overflow during fat16 resize
CVE-2026-89098 5.5 MEDIUM Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd
CVE-2026-85977 5.3 MEDIUM Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re
CVE-2026-17591 3.6 LOW Libarchive: libarchive: use-after-free via aliased mac metadata copy
CVE-2026-111581 3.3 LOW Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-770

V. Comments for CVE-2026-85231

No comments yet

Leave a comment