CVE-2026-85977

Name	CVE-2026-85977
Description	A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151102

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libtirpc (PTS)	bookworm	1.3.3+ds-1	vulnerable
	trixie	1.3.6+ds-1	vulnerable
	forky, sid	1.3.7+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libtirpc	source	(unstable)	(unfixed)			1151102

Fixed by: http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=ccc1acf867d88dc0bdbe58568f621607d44977f5 (libtirpc-1-3-8-rc2)