Critical Security Update for rpcbind: Addressing CVE-2026-94640
Summary
RHSA-2026:83563: Red Hat Security Advisory: rpcbind security update. Affects rpcbind versions < 0:1.2.5-11.el8_10. Fixed in 0:1.2.5-11.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rpcbind is a server that converts RPC program numbers into universal addresses. It is a crucial component in network services that rely on RPC, allowing clients to locate the services they need. The package is widely used in enterprise environments, particularly within Red Hat Enterprise Linux 8. The vulnerability in rpcbind could potentially expose systems to unauthorized access or denial of service, making it essential to address promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-94640 in rpcbind allows for potential unauthorized access and denial of service attacks. This issue arises from improper handling of certain requests, which could lead to system instability or exposure of sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level, and it is crucial for users to apply the necessary updates to mitigate risks associated with this flaw.
How To Fix
Minimum fixed version
0:1.2.5-11.el8_10
This is the first release that contains the fix.
sudo dnf update rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling rpcbind temporarily until the update can be applied. This can be done by running the command:
sudo systemctl stop rpcbind' and 'sudo systemctl disable rpcbind
However, this may disrupt services that rely on RPC.
Conclusion
The rpcbind vulnerability CVE-2026-94640 poses significant risks to systems running Red Hat Enterprise Linux 8. It is crucial to update to the patched version to ensure system security. Users should also consider using tools like Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a service that maps RPC program numbers to network addresses, allowing clients to find the services they need.
CVE-2026-94640 is a vulnerability in rpcbind that can lead to unauthorized access and denial of service.
The vulnerability has a CVSS score of 7.5, indicating it is of high severity and should be addressed promptly.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot apply the update right away, consider disabling the rpcbind service to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
