Libtirpc is a lightweight RPC (Remote Procedure Call) library that provides core transport-independent RPC services used widely in networked systems and NFS implementations, making it a critical but low-visibility component of many Unix and Linux distributions. The observed vulnerability exposure centers on resource-handling and exception-management weaknesses—infinite loops, unbounded resource allocation, improper handling of exceptional conditions, and unchecked return values—that are characteristic of C-level parsing and protocol-state code. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libtirpc Project over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-8779HIGH rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR st | May 4, 2017 | 7.5 | 84 | NO | YES |
CVE-2021-46828HIGH In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lea | Jul 20, 2022 | 7.5 | 27 | NO | NO |
CVE-2013-1950MEDIUM The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that tri | Jul 9, 2013 | 4.3 | 27 | NO | YES |
CVE-2018-14622HIGH A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a c | Aug 30, 2018 | 7.5 | 26 | NO | NO |
CVE-2018-14621HIGH An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server | Aug 30, 2018 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libtirpc Project.
Media articles that mention a CVE ID that affects a product developed by Libtirpc Project — matched by CVE ID, not by vendor name.