CVE-2026-85977

The record

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Affected packages

Related vulnerabilities

• CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19… CWE-1050
• CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried… CWE-1050
• CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid… CWE-1050
• CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. CWE-1050
• CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. CWE-1050
• CVE-2026-44390 NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling… CWE-1050
• CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of… CWE-1050
• CVE-2026-4634 A flaw was found in Keycloak. CWE-1050