Infinite loop in [UNKNOWN] libtirpc
Priority LOW 37CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-835.
Summary
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted.
Why it matters now
EPSS 0.02262 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| [UNKNOWN] | libtirpc | 1.0.2-rc2 | — | No fix listed | CNA |
- libtirpc Vendor[UNKNOWN] Affected 1.0.2-rc2 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libtirpc_project:libtirpc:*:*:*:*:*:*:*:* | up to 1.0.1 | Vulnerable | Libtirpc Project |
| cpe:2.3:a:libtirpc_project:libtirpc:1.0.2:rc1:*:*:*:*:*:* | 1.0.2 rc1 | Vulnerable | Libtirpc Project |
- cpe:2.3:a:libtirpc_project:libtirpc:*:*:*:*:*:*:*:* Versions up to 1.0.1 Vulnerable ·Libtirpc Project
- cpe:2.3:a:libtirpc_project:libtirpc:1.0.2:rc1:*:*:*:*:*:* Versions 1.0.2 rc1 Vulnerable ·Libtirpc Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 8 products
- Red Hat Ceph Storage 2
- Red Hat Ceph Storage 3
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Enterprise 3
- Red Hat Storage 3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-14621
- 2026-10-03 Alias added: GHSA-362j-4wp6-47gj
References
More Libtirpc Project Libtirpc vulnerabilities
- TI-2017-06291 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC… CVSS 3.0HIGH 7.5
- TI-2021-21520 In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a… CVSS 3.1HIGH 7.5
- TI-2018-10487 A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. CVSS 3.1HIGH 7.5
- TI-2013-01725 The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2018-14621 · CVE Program
- CVE-2018-14621 · NVD
- FIRST EPSS
- GHSA-362j-4wp6-47gj · GitHub Advisory Database · CC BY 4.0
- CVE-2018-14621 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences