What happened
A vulnerability has been identified in the libtirpc library, designated as CVE-2026-85231. This flaw allows an authenticated remote attacker to exploit the service by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS for integrity or privacy. Successful exploitation can result in unbounded memory allocation, which exhausts system resources and leads to a Denial of Service (DoS). The service affected may become unstable or terminate as a result of resource exhaustion, impairing system availability.
Who is affected
This vulnerability impacts deployments using Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images and Red Hat OpenShift Container Platform 4, where the libtirpc library is configured with RPCSEC_GSS. Any organisations running these products with exposed RPC services that permit authenticated remote connections and utilise RPCSEC_GSS with integrity or privacy settings are potentially vulnerable. The attack necessitates network access to the affected service, does not require user action, and low-privileged accounts are sufficient for exploitation.
Recommended actions
- Implement network segmentation and access controls to restrict remote access to RPC services, ensuring only trusted sources can connect.
- Review and restrict network exposure of RPC services configured with RPCSEC_GSS, particularly those accepting oversized requests or not configured with additional security layers.
- Monitor for unusual or excessive activity on RPC services, focusing on large data requests or abnormal connection patterns.
