Hi,

The following vulnerability was published for libtirpc.

CVE-2026-85977[0]:
| A flaw was found in libtirpc. A remote attacker can exploit this
| vulnerability by sending specially crafted PMAPPROC_DUMP replies to
| a client application that uses the pmap_getmaps() function against
| an attacker-controlled host. This unbounded decoding can lead to
| excessive memory and CPU allocation, causing the client process to
| experience a Denial of Service (DoS) due to resource exhaustion.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85977
https://www.cve.org/CVERecord?id=CVE-2026-85977
[1] http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=ccc1acf867d88dc0bdbe58568f621607d44977f5

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore