Critical rpcbind Vulnerability: Unbounded Memory Allocation Leading to Remote Denial of Service
Summary
RLSA-2026:83561: Important: rpcbind security update. Affects rpcbind versions < 0:1.2.7-3.el10_2.1. Fixed in 0:1.2.7-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rpcbind is a server utility that plays a crucial role in converting Remote Procedure Call (RPC) program numbers into universal addresses. It is essential for enabling RPC calls on a server within the same machine. The utility must be actively running on the host for proper functionality, making it a critical component in network communication for various applications.
Vulnerability Detail
The rpcbind utility is affected by an unbounded memory allocation issue in its statistics tracking feature. This vulnerability allows unauthenticated remote attackers to exploit the service, potentially leading to a denial of service (DoS). The root cause lies in the way rpcbind handles memory allocation, which can be manipulated to exhaust system resources, rendering the service unresponsive. The CVSS score for this vulnerability is 7.5, indicating a significant risk to affected systems.
How To Fix
Minimum fixed version
0:1.2.7-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the rpcbind service by configuring your firewall to block unauthorized access. This can be achieved with the following command:
sudo firewall-cmd --add-rich-rule="rule family='ipv4' source address='0.0.0.0/0' service name='rpcbind' reject"
This will prevent unauthenticated users from accessing the service until the patch is applied.
Conclusion
The rpcbind utility is critical for RPC communication, but it is currently vulnerable to a significant denial of service attack due to unbounded memory allocation. It is essential to update to the patched version to mitigate this risk and ensure system stability.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server utility that converts RPC program numbers into universal addresses, enabling RPC calls on a server.
The vulnerability involves unbounded memory allocation in rpcbind's statistics tracking, allowing remote denial of service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.5, indicating a critical risk level.
You can update the rpcbind package by running 'sudo yum update rpcbind' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
