Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
Affects the rpcbind package on Red Hat Enterprise Linux 10, with the fixed build rpcbind-1.2.7-3.el10_2.1. Red Hat's advisory lists further affected RHEL and OpenShift Container Platform releases.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in rpcbind-1.2.7-3.el10_2.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- rpcbind
Version range not reported
- rpcbind
Version range not reported
- rpcbind
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- rpcbind
Version range not reported
- rpcbind
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
References 6
access.redhat.com
bugzilla.redhat.com
Questions about CVE-2026-94640
What does this mean?
rpcbind tracks statistics and allocates memory for them without any upper limit. A remote client that does not need to log in can make the service use up memory, which denies service to legitimate users.Source: access.redhat.com
Am I affected, and how do I check?
Red Hat lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and OpenShift Container Platform 4 and 5 as products in scope. The advisory's stated condition is RHEL 10 with the rpcbind package installed, which you can check with `rpm -q rpcbind`.Source: access.redhat.com
What should I do about it?
Update rpcbind on Red Hat Enterprise Linux 10 to rpcbind-1.2.7-3.el10_2.1 or later. The sources provided do not list a fixed build for the other listed products.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data