Hi,

The following vulnerability was published for libtirpc.

CVE-2026-85231[0]:
| A flaw was found in libtirpc. An authenticated remote attacker could
| exploit this vulnerability by sending oversized wrapped data
| requests to an RPC (Remote Procedure Call) service configured with
| RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service)
| integrity or privacy. This can lead to unbounded memory allocation,
| resulting in a Denial of Service (DoS) by exhausting system
| resources and causing the service to become unstable or terminate.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85231
https://www.cve.org/CVERecord?id=CVE-2026-85231
[1] http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=65d27459fe569a678cb5cc67d308bcf12c49cb40

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore