Critical Remote Denial of Service Vulnerability in rpcbind Package
Summary
RLSA-2026:83563: Important: rpcbind security update. Affects rpcbind versions < 0:1.2.5-11.el8_10. Fixed in 0:1.2.5-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rpcbind is a utility that plays a crucial role in the Remote Procedure Call (RPC) framework by converting RPC program numbers into universal addresses. It is essential for enabling RPC calls on a server, ensuring that applications can communicate effectively over a network. The rpcbind service must be running on the host machine for RPC calls to function, making it a critical component in distributed systems.
Vulnerability Detail
The rpcbind utility has an unbounded memory allocation issue in its statistics tracking feature, which can be exploited by unauthenticated remote attackers to cause a denial of service (DoS). This vulnerability, identified as CVE-2026-94640, allows attackers to consume excessive memory resources, potentially leading to service outages and disruption of legitimate RPC calls. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:1.2.5-11.el8_10
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rpcbind service if it is not required for their applications. This can be done by running the command:
sudo systemctl stop rpcbind' followed by 'sudo systemctl disable rpcbind
However, this may impact applications that rely on RPC calls.
Conclusion
The rpcbind package has a critical vulnerability that can lead to remote denial of service attacks. It is essential for users to update to the latest patched version to protect their systems. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server utility that converts RPC program numbers into universal addresses, enabling RPC calls on a server.
CVE-2026-94640 refers to a specific vulnerability in rpcbind that allows unauthenticated remote denial of service due to unbounded memory allocation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, consider disabling the rpcbind service as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
