DEBIAN-CVE-2026-89096
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-89096
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89096.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-89096
- Upstream
- CVE-2026-89096
- Published
- 2026-10-17T09:47:27Z
- Modified
- 2026-10-17T10:00:08Z
- Summary
- [none]
- Details
-
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
- References
Affected packages
Debian:12 / nfs-utils
Package
- Name
- nfs-utils
- Purl
- pkg:deb/debian/nfs-utils?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1:2.*
1:2.6.2-4
1:2.6.2-4+deb12u1
1:2.6.3-1~exp1
1:2.6.3-1
1:2.6.3-2
1:2.6.3-3
1:2.6.3-4~exp1
1:2.6.4-1~exp1
1:2.6.4-1
1:2.6.4-2
1:2.6.4-3
1:2.6.4-4
1:2.6.4-5
1:2.6.4-6
1:2.7.1-1~exp1
1:2.7.1-1
1:2.7.1-2
1:2.7.1-3
1:2.8.1-1~exp1
1:2.8.1-1
1:2.8.1-2
1:2.8.2-1
1:2.8.2-2~exp1
1:2.8.2-2
1:2.8.2-3
1:2.8.3-1~exp1
1:2.8.3-1
1:2.8.4-1
1:2.8.4-2
1:2.8.5-1
1:2.8.6-1
1:2.8.7-1
1:2.9.1-1
1:2.9.2-1
1:3.*
1:3.1.1-1
Debian:13 / nfs-utils
Package
- Name
- nfs-utils
- Purl
- pkg:deb/debian/nfs-utils?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / nfs-utils
Package
- Name
- nfs-utils
- Purl
- pkg:deb/debian/nfs-utils?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1:3.1.1-1