CVE-2017-8779: rpcbind, libtirpc and ntirpc unbounded XDR allocation denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication, has a high CVSS score of 7.5, and public exploit code exists, though it only causes denial of service and is not listed in CISA KEV.

What it is

rpcbind through 0.2.4, libtirpc through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and ntirpc through 1.4.3 allocate memory for XDR strings without enforcing the maximum RPC data size. A remote attacker can send a crafted UDP packet to port 111 and exhaust memory with no subsequent free, causing a denial of service. The flaw is tracked as rpcbomb and affects core RPC infrastructure used by many Unix-like systems.

Impact

An unauthenticated remote attacker can consume memory on the target host until services become unresponsive or the system fails, disrupting RPC-dependent operations. There is no confidentiality or integrity impact; the effect is availability loss.

Attack surface

The flaw is reachable over the network via a crafted UDP packet sent to port 111, the rpcbind portmapper service. No authentication or user interaction is required, as reflected by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.8123 (99.6th percentile) and public proof-of-concept code exists in references such as the rpcbomb GitHub repository and Exploit-DB 41974. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply vendor patches for rpcbind, libtirpc and ntirpc; Red Hat, Debian, Ubuntu, Gentoo and NetApp advisories are referenced.
• Restrict UDP and TCP access to port 111 to trusted hosts using firewall rules or network segmentation.
• Disable or remove rpcbind where it is not required for NFS or other RPC services.
• Monitor memory usage on hosts running rpcbind and restart the service if it grows unexpectedly.

Detection

• Monitor for abnormal memory growth or OOM events on hosts running rpcbind.
• Inspect network traffic for unusually large or malformed UDP packets directed to port 111.
• Alert on repeated or high-volume UDP traffic to port 111 from untrusted sources.
• Review rpcbind service logs and process restarts for signs of resource exhaustion.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.