VULNERABILITY INTELLIGENCE
CVE-2026-85231
CVSS score6.5 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-10-16
Last modified2026-10-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
Weakness classification
- secalert@redhat.com: CWE-770