Skip to content
Fencer Vulns
high 7.1

CVE-2026-53689 json

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS se…

published 2026-06-10 4 mo ago modified 2026-10-26 13 d ago also EUVD-2026-36027

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.

Patch / fix

  • libnfs Debian 12 4.0.0-1+deb12u1
  • libnfs Debian 13 5.0.2-1+deb13u1
  • libnfs Debian 14 5.0.2-1.1

debian advisories DEBIAN-CVE-2026-53689

  • libnfs Ubuntu 22.04 LTS 4.0.0-1ubuntu0.1
  • libnfs Ubuntu 24.04 LTS 5.0.2-1ubuntu0.24.04.1
  • libnfs Ubuntu 25.10 5.0.2-1ubuntu0.25.10.1
  • libnfs Ubuntu 26.04 LTS 5.0.2-1ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-53689

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libnfs SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 1.11.0-150000.3.3.1
  • libnfs Linux Micro 6.1 5.0.2-slfo.1.1_2.1
  • libnfs SLES for SAP applications 16.0, SLES 16.0 5.0.3-160000.4.1

suse advisories SUSE-SU-2026:2760-1SUSE-SU-2026:22447-1SUSE-SU-2026:22363-1

  • libnfs openSUSE Tumbleweed 6.0.2-1.1
  • libnfs openSUSE Leap 16.0 5.0.3-160000.4.1

opensuse advisories openSUSE-SU-2026:11246-1openSUSE-SU-2026:21055-1

  • libnfs Azure Linux 3.0 5.0.2-2

azure linux advisories AZL-90153

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53689 updated cvss 7.1

libnfs: libnfs: Information disclosure and data corruption via crafted NFS server connection

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Affected products

  • sahlberg libnfs

Classification

Weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.