CVE-2026-85977 Red Hat CVE debrief

Who should care

Defenders responsible for libtirpc installations, especially in environments where remote access to services using pmap_getmaps() is possible, should assess exposure and prioritize verification and patching.

Why it matters

CVE-2026-85977 is a Denial of Service (DoS) vulnerability in libtirpc that can be exploited by a remote attacker, potentially impacting services using pmap_getmaps(). Defenders should verify and patch vulnerable installations.

• Potential Denial of Service (DoS) due to resource exhaustion
• Need for verification of vulnerable libtirpc installations
• Possible impact on services relying on pmap_getmaps()

Technical summary

The libtirpc library is vulnerable to a Denial of Service (DoS) attack due to unbounded decoding of PMAPPROC_DUMP replies. A remote attacker can exploit this by sending specially crafted replies to a client application using the pmap_getmaps() function against an attacker-controlled host, leading to excessive memory and CPU allocation. The vulnerability affects libtirpc installations, particularly in environments where remote access to services using pmap_getmaps() is possible. Defenders should verify and patch vulnerable libtirpc installations.

Defensive priority

Defenders should prioritize verifying and patching vulnerable libtirpc installations, especially in environments where remote access to services using pmap_getmaps() is possible.

Recommended defensive actions

• Verify and patch vulnerable libtirpc installations
• Monitor for suspicious PMAPPROC_DUMP activity
• Implement rate limiting on pmap_getmaps() requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions, exploitation, and remediation is limited. Defenders should verify and patch vulnerable libtirpc installations, especially in environments where remote access to services using pmap_getmaps() is possible. The vulnerability can be exploited by a remote attacker, potentially impacting services using pmap_getmaps().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.