CVE-2026-85231 in libtirpc
Summary
by MITRE • 10/16/2026
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within libtirpc represents a critical security flaw affecting systems that utilize Remote Procedure Call services configured with RPCSEC_GSS for integrity or privacy protection. This library serves as a foundational component for implementing secure remote procedure calls, particularly in environments requiring authentication and data confidentiality through the Generic Security Service Application Program Interface framework. The core of this issue lies in how the application handles incoming network requests that have been wrapped using GSS-API mechanisms. When an authenticated attacker sends oversized wrapped data packets to such a service, the system fails to adequately validate or bound the size of these inputs before processing them for decryption and unwrapping operations. This lack of input validation allows malicious actors to trigger unbounded memory allocation within the server process.
From a technical perspective, this flaw is classified under CWE-400, which denotes Uncontrolled Resource Consumption, specifically manifesting as an excessive allocation of system resources during request processing. The vulnerability exploits the fact that RPCSEC_GSS involves complex cryptographic operations where data must be unwrapped and verified before being passed to the application layer. If the size of the wrapped payload is not strictly limited prior to these intensive memory-intensive operations, the server may attempt to allocate a buffer significantly larger than intended or available. This behavior leads directly to CWE-125, Out-of-bounds Read scenarios if the allocation fails partially, or more commonly in this context, results in severe performance degradation due to resource exhaustion as described by CWE-789. The attacker does not need elevated privileges beyond what is required for authentication, making it accessible to any user with valid credentials who can interact with the RPC service.
The operational impact of exploiting this vulnerability is primarily a Denial of Service condition. By repeatedly sending these oversized wrapped requests, an adversary can exhaust the available memory on the host system or within the specific process space running the RPC service. This resource exhaustion causes the affected service to become unstable, potentially leading to crashes, unresponsiveness, or complete termination by the operating system's out-of-memory killer mechanisms. Such instability disrupts critical business functions that rely on remote procedure calls for inter-process communication across networked systems. In enterprise environments where libtirpc is used for NFSv4 mounts, directory services, or other distributed computing tasks, this disruption can lead to significant downtime and loss of availability for dependent applications and users.
This vulnerability aligns with the MITRE ATT&CK technique T1498, Network Denial of Service, specifically under the sub-technique of Resource Exhaustion via Uncontrolled Consumption. It highlights a common pattern in network-facing services where input size limits are not enforced at the protocol handling layer before resource-intensive cryptographic operations begin. The attack vector is remote and requires authentication, which places it within the context of authenticated attacks that target service availability rather than data confidentiality or integrity directly. While the primary outcome is denial of service, the instability caused by memory exhaustion could potentially lead to secondary issues such as information leakage if crash dumps are generated containing sensitive operational data, although this is a secondary risk compared to the immediate impact on availability.
Mitigation strategies for this vulnerability focus primarily on applying vendor-provided patches that update libtirpc to versions where input validation and size limits have been strictly enforced before memory allocation occurs. System administrators should ensure that all systems running RPC services with GSS security are updated promptly. Additionally, network-level mitigations can be employed by configuring firewalls or intrusion prevention systems to limit the maximum packet size allowed for RPC traffic, thereby preventing oversized wrapped requests from reaching the vulnerable service layer. Implementing rate limiting on authentication endpoints and monitoring system memory usage patterns can also help in detecting potential exploitation attempts early. Organizations should review their dependency management processes to ensure that libtirpc is kept up-to-date across all infrastructure components relying on secure remote procedure calls.