Critical rpcbind Vulnerability in AlmaLinux: Unbounded Memory Allocation Leading to Denial of Service
Summary
ALSA-2026:83561: Important: rpcbind security update. Affects rpcbind versions < 1.2.7-3.el10_2.1. Fixed in 1.2.7-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rpcbind is a server utility that plays a crucial role in the Remote Procedure Call (RPC) framework by converting RPC program numbers into universal addresses. It is essential for enabling RPC calls on a server, ensuring that applications can communicate effectively over a network. The rpcbind service must be running on the host machine to facilitate these calls, making it a critical component in many networked environments. However, its functionality also makes it a target for security vulnerabilities, such as the one identified in this advisory.
Vulnerability Detail
The vulnerability identified as CVE-2026-94640 involves an unbounded memory allocation in rpcbind's statistics tracking feature. This flaw allows an unauthenticated remote attacker to exploit the service, potentially leading to a denial of service (DoS) condition. The attacker can cause the rpcbind service to consume excessive memory, resulting in service disruption and making the system unresponsive. This vulnerability highlights the importance of securing rpcbind, as it is often exposed to network traffic and can be targeted by malicious actors.
How To Fix
Minimum fixed version
1.2.7-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the rpcbind service temporarily to mitigate the risk of exploitation. This can be done with the command:
sudo systemctl stop rpcbind' and 'sudo systemctl disable rpcbind
However, be aware that this may disrupt any applications relying on RPC services.
Conclusion
The rpcbind vulnerability identified as CVE-2026-94640 poses a significant risk to systems running the AlmaLinux package. It is crucial to address this issue promptly by updating to the patched version of rpcbind to prevent potential denial of service attacks. Users are encouraged to monitor their systems and utilize tools like Vulert to stay informed about vulnerabilities.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server utility that converts RPC program numbers into universal addresses, allowing applications to communicate over a network.
CVE-2026-94640 refers to a vulnerability in rpcbind that allows for unbounded memory allocation, potentially leading to a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider stopping and disabling the rpcbind service to reduce the risk of exploitation.
For more details, refer to the CVE page associated with CVE-2026-94640, which provides in-depth information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
