Source: libtirpc Version: 1.3.7+ds-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for libtirpc. CVE-2026-85231[0]: | A flaw was found in libtirpc. An authenticated remote attacker could | exploit this vulnerability by sending oversized wrapped data | requests to an RPC (Remote Procedure Call) service configured with | RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) | integrity or privacy. This can lead to unbounded memory allocation, | resulting in a Denial of Service (DoS) by exhausting system | resources and causing the service to become unstable or terminate. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-85231 https://www.cve.org/CVERecord?id=CVE-2026-85231 [1] http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=65d27459fe569a678cb5cc67d308bcf12c49cb40 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
