High advisory for rpcbind
OESA-2026-4689 · Reported 4 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
Advisory overview
The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es): A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)
Affected packages and releases
openEuler:24.03-LTS-SP4 / rpcbind
introduced: 0 · fixed: 1.2.6-9.oe2403sp4