CVE-2026-85977

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

This Moderate availability flaw in libtirpc affects client applications that utilize the pmap_getmaps() function against attacker-controlled or spoofed endpoints. While exploitable over the network without authentication, successful exploitation requires the vulnerable client-side portmapper path to be actively used, limiting its broad applicability compared to typical remote denial-of-service vulnerabilities. The impact is confined to resource exhaustion of the client process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring applications that use pmap_getmaps() to query untrusted or attacker-controlled portmapper services. If such functionality is essential, restrict network access for services utilizing pmap_getmaps() to only trusted hosts via firewall rules. Additionally, consider isolating client applications that call pmap_getmaps() into constrained environments to limit the impact of potential resource exhaustion.