OESA-2026-4686: rpcbind security update
The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es):
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpcbindto a version that resolves this vulnerability.Fixed in 1.2.6-9.oe2203sp4
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service issue?
Hosts running the rpcbind service are exposed. The service must be running because it handles RPC program-number-to-address conversion for RPC calls on the local machine.
What does an attacker need to exploit the issue?
An attacker can exploit it remotely without authentication or user interaction by sending a large number of unique requests to rpcbind.
What operational impact should be monitored?
Previously unseen RPC statistics are stored in unbounded in-memory lists, causing persistent memory growth and increased CPU usage. This can degrade rpcbind availability or exhaust the host resources available to the service.