Critical Remote Denial of Service Vulnerability in rpcbind
Summary
RLSA-2026:83562: Important: rpcbind security update. Affects rpcbind versions < 0:1.2.6-7.el9_8.1. Fixed in 0:1.2.6-7.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
rpcbind is a server utility that plays a crucial role in converting Remote Procedure Call (RPC) program numbers into universal addresses. It is essential for enabling RPC calls on a server, allowing various network services to communicate effectively. The utility must be running on the host machine to facilitate these calls, making it a critical component in networked environments. However, rpcbind has been found to have a significant security vulnerability that could expose systems to remote denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-94640 is characterized by unbounded memory allocation in rpcbind's statistics tracking. This flaw allows unauthenticated remote attackers to exploit the rpcbind service, potentially leading to a denial of service condition. The vulnerability arises from improper handling of memory allocation, which can be triggered by sending specially crafted requests to the rpcbind service. The ramifications of this vulnerability are severe, as it can render the affected service inoperable, disrupting network operations and service availability.
How To Fix
Minimum fixed version
0:1.2.6-7.el9_8.1
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the rpcbind service by configuring firewall rules to limit incoming connections. This can be done using the following command:
sudo firewall-cmd --add-port=111/tcp --permanent' followed by 'sudo firewall-cmd --reload' to apply the changes.
Conclusion
The rpcbind utility is critical for enabling RPC calls in networked environments, but it is vulnerable to a significant denial of service attack due to unbounded memory allocation. Users are urged to update to the latest patched version to mitigate this risk. Additionally, temporary workarounds can be implemented to restrict access until the update is applied.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server utility that converts RPC program numbers into universal addresses, enabling network services to communicate.
CVE-2026-94640 is a vulnerability in rpcbind that allows unauthenticated remote denial of service due to unbounded memory allocation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can update rpcbind by running 'sudo dnf update rpcbind' on Rocky Linux 9 to ensure you have the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
