CVE-2017-8779: Libtirpc Project Libtirpc

High severity, CVSS 7.5. EPSS: 81.2% chance of exploitation in the next 30 days.

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

Affected products

• Libtirpc Project Libtirpc: up to and including 1.0.1
• Ntirpc Project Ntirpc: up to and including 1.4.3
• Rpcbind Project Rpcbind: up to and including 0.2.4

Published 2017-05-04. Last modified 2026-06-17.