Critical Security Flaw in rpcbind: Unbounded Memory Allocation Vulnerability
Summary
ALSA-2026:83563: Important: rpcbind security update. Affects rpcbind versions < 1.2.5-11.el8_10. Fixed in 1.2.5-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rpcbind is a server utility that plays a crucial role in converting Remote Procedure Call (RPC) program numbers into universal addresses. It is essential for enabling RPC calls on a server within the same machine. The utility must be actively running on the host for proper functionality, making it a critical component in network communications and service management.
Vulnerability Detail
The vulnerability identified as CVE-2026-94640 pertains to an unbounded memory allocation issue within rpcbind's statistics tracking. This flaw allows unauthenticated remote attackers to exploit the service, potentially leading to a denial of service (DoS) condition. The lack of proper memory allocation checks can result in excessive memory consumption, causing the service to crash or become unresponsive, thereby disrupting operations relying on RPC calls.
How To Fix
Minimum fixed version
1.2.5-11.el8_10
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the rpcbind service if it is not required for your operations. This can be done by running the command:
sudo systemctl stop rpcbind' and 'sudo systemctl disable rpcbind
However, this may impact applications that depend on RPC services.
Conclusion
The rpcbind utility is critical for enabling RPC calls, but it is vulnerable to an unbounded memory allocation issue that can lead to denial of service attacks. It is essential to update to the patched version to secure your system and maintain operational integrity.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server utility that converts RPC program numbers into universal addresses, allowing for RPC calls on a server.
CVE-2026-94640 refers to an unbounded memory allocation vulnerability in rpcbind that can lead to denial of service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may allow attackers to exploit the rpcbind service, leading to service disruptions and potential downtime.
Yes, you can temporarily disable the rpcbind service if it is not essential for your operations to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
