CVE-2026-89096

MediumCVSS 5.9/10Last modified Nov 6, 2026

Description

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 5—

References

Timeline

Published
Oct 16, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-890974.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and iCVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertiCVE-2026-890997.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory wiCVE-2026-89106.1The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This isCVE-2026-891006.1The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL FragmentCVE-2026-891016.5The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure DiCVE-2026-891026.5In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lCVE-2026-8910310.0SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal applicatCVE-2026-891054.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUCVE-2026-891064.4SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crCVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilCVE-2026-891089.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function