CVE-2026-89096CWE-772

CVE-2026-89096

Medium · published October 17, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-10-17T03:17Z
References (2)
https://access.redhat.com/security/cve/CVE-2026-89096 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2462372 · [email protected]
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 16 OCT 23:06Z
    Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
    cvelistv5
  • 16 OCT 23:06Z
    Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
    cvelistv5