CVE-2026-94640
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | rpcbind | 1.2.7-3.el10_2.1 |
| AlmaLinux 8 | rpcbind | 1.2.5-11.el8_10 |
| AlmaLinux 9 | rpcbind | 1.2.6-7.el9_8.1 |
| Debian 12 | rpcbind | no fix |
| Debian 13 | rpcbind | no fix |
| Debian 14 | rpcbind | no fix |
| Red Hat Enterprise Linux 10.2 | rpcbind | 0:1.2.7-3.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | rpcbind-debuginfo | 0:1.2.7-3.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | rpcbind-debugsource | 0:1.2.7-3.el10_2.1 |
| Red Hat Enterprise Linux 8 | rpcbind | 0:1.2.5-11.el8_10 |
| Red Hat Enterprise Linux 8 | rpcbind-debuginfo | 0:1.2.5-11.el8_10 |
| Red Hat Enterprise Linux 8 | rpcbind-debugsource | 0:1.2.5-11.el8_10 |
| Red Hat Enterprise Linux 9 | rpcbind | 0:1.2.6-7.el9_8.1 |
| Red Hat Enterprise Linux 9 | rpcbind-debuginfo | 0:1.2.6-7.el9_8.1 |
| Red Hat Enterprise Linux 9 | rpcbind-debugsource | 0:1.2.6-7.el9_8.1 |
| Rocky Linux 10 | rpcbind | 0:1.2.7-3.el10_2.1 |
| Rocky Linux 8 | rpcbind | 0:1.2.5-11.el8_10 |
| Rocky Linux 9 | rpcbind | 0:1.2.6-7.el9_8.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Micro 5.3 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Micro 5.4 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Micro 5.5 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | rpcbind | 0.2.3-24.18.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server 16.0 | rpcbind | 1.2.9-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | rpcbind | 0.2.3-24.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | rpcbind | 0.2.3-150000.5.17.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rpcbind | 1.2.9-160000.3.1 |
| SUSE Linux Micro 6.2 | rpcbind | 1.2.9-160000.3.1 |
| Ubuntu 18.04 LTS | rpcbind | no fix |
| Ubuntu 20.04 LTS | rpcbind | no fix |
| Ubuntu 22.04 LTS | rpcbind | no fix |
| Ubuntu 24.04 LTS | rpcbind | no fix |
| Ubuntu 26.04 LTS | rpcbind | no fix |
| Ubuntu 26.10 | rpcbind | no fix |
| Ubuntu Pro 14.04 LTS | rpcbind | no fix |
| Ubuntu Pro 16.04 LTS | rpcbind | no fix |
| openSUSE Leap 16.0 | rpcbind | 1.2.9-160000.3.1 |
| openSUSE Tumbleweed | rpcbind | 1.2.9-3.1 |