CVE-2026-89096
Last modified
CVE-2026-89096 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat OpenShift Container Platform 4 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-89096?
How severe is CVE-2026-89096?
How do I fix CVE-2026-89096?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8909The WpMobi plugin for WordPress is vulnerable to Cross-Site …4.3
- CVE-2026-89090An unrecovered panic in the event stream header decoder in A…5.9
- CVE-2026-89091A flaw was found in ansible-core. When installing a collecti…8.8
- CVE-2026-89092The nscd service in the GNU C Library 2.3.4 onwards may cras…4.2
- CVE-2026-89093The Better Messages – Chat Rooms, Group Chat, Private Messag…5.3
- CVE-2026-89094Forgejo before 16.0.4 allows remote code execution via a cra…9.9
- CVE-2026-89097The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…4.3
- CVE-2026-89098A flaw was found in nfs-utils. The fsidd daemon improperly h…5.5
- CVE-2026-89099A race condition in the document value layer of MongoDB Serv…7.5
- CVE-2026-8910The WP Emoticon Rating plugin for WordPress is vulnerable to…6.1
- CVE-2026-89100The Payment Plugins for Stripe WooCommerce plugin for WordPr…6.1
- CVE-2026-89102In wolfSSL versions 5.7.2 through 5.9.2 there is a client-si…6.5
Are you affected by CVE-2026-89096?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST