Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
8118 articles · 242418 vulns · 37/41 feeds (7d)
← Back to list
5.9
CVE-2026-89096EXPLOITED
red hat · red hat enterprise linux

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

Description

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Affected Products

VendorProductVersions
red hatred hat enterprise linux—

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
open sourceopen source nfs-utilscert_advisory90%

References

  • https://access.redhat.com/security/cve/CVE-2026-89096(vdb-entry, x_refsource_REDHAT)
  • https://bugzilla.redhat.com/show_bug.cgi?id=2462372(issue-tracking, x_refsource_REDHAT)

Related News (2 articles)

Tier B
BSI Advisories9h ago
[NEU] [UNGEPATCHT] [mittel] nfs-utils: Mehrere Schwachstellen ermöglichen Denial of Service
→ No new info (linked only)
Tier C
VulDB2d ago
CVE-2026-89096 | Red Hat Enterprise Linux/OpenShift Container Platform rpc.statd denial of service
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.15.9 NONE
CISA KEV❌ No
Actively exploited✅ Yes
CWECWE-772
PublishedOct 16, 2026
Last enriched2d ago
Tags
remote code executionfile manipulationdenial of servicemultiple vulnerabilities
Trending Score49
Source articles2
Independent2
Info Completeness5/14
Missing: vendor, product, versions, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

NONECVE-2026-112210EXP
Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
Trending: 53
NONECVE-2026-112214EXP
Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
Trending: 49
NONECVE-2026-112260EXP
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
Trending: 47
NONECVE-2026-62439
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
Trending: 43
NONECVE-2026-16460EXP
Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
Trending: 41

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 16, 2026
Discovered by ZDM
Oct 16, 2026
Actively Exploited
Oct 19, 2026
Exploit Available
Oct 19, 2026