CVE-2021-46828 @ Archive

"CVE-2021-46828"
"libtirpc-common-1.1.4-0.4+deb10u1"
"libtirpc"
"libtirpc1-0.2.5-1.2+deb9u1"
"libtirpc3-1.1.4-0.4+deb10u1"
"Am I vulnerable?"

Status

new

Priority

0.62

Match score

4.0

Risk

DoS Remote

CVSS

7.5 HIGH

Reason

cpe: libtirpc; pkgs: libtirpc-common; version: in-range: libtirpc-common-1.1.4-0.4+deb10u1; risk:dos

Created

2026-10-15T10:20:35Z

Updated

2026-10-20T10:18:44Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
libtirpc-common-1.1.4-0.4+deb10u1
libtirpc
libtirpc1-0.2.5-1.2+deb9u1
libtirpc3-1.1.4-0.4+deb10u1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: libtirpc-common · libtirpc

System	Matches	Ticket for CVE-2021-46828
Archive	libtirpc-common 1.1.4-0.4+deb10u1; libtirpc1 0.2.5-1.2+deb9u1; libtirpc3 1.1.4-0.4+deb10u1	new open
Saiph	libtirpc-common 1.1.4-0.4+deb10u1; libtirpc1 0.2.5-1.2+deb9u1; libtirpc3 1.1.4-0.4+deb10u1	new open
morris	libtirpc 0.2.4	new open
mufasa	libtirpc 0.2.4	new open
Bullseye	libtirpc-common 1.3.1-1+deb11u1; libtirpc3 1.3.1-1+deb11u1	none
Helios	libtirpc-common 1.3.1-1+deb11u1; libtirpc-dev 1.3.1-1+deb11u1; libtirpc3 1.3.1-1+deb11u1	none
Library	libtirpc1 0.2.5-1.2+deb9u1	none
Matrix	libtirpc-common 1.3.3+ds-1; libtirpc1 0.2.5-1.2+deb9u1; libtirpc3 1.3.3+ds-1	none
Silk	libtirpc-common 1.3.3+ds-1; libtirpc-dev 1.3.3+ds-1; libtirpc3 1.3.3+ds-1	none

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 5.10.0-25-amd64

kernel_version

uname -v → #1 SMP Debian 5.10.191-1 (2023-08-16)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	new	7.0	2026-10-20T10:18:44Z	Open
mufasa	new	7.0	2026-10-20T10:18:44Z	Open
Saiph	new	0.62	2026-10-20T10:18:44Z	Open

Description

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Update status

Add note only

References

NVD: CVE-2021-46828