OESA-2026-4687: rpcbind security update
The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es):
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpcbindto a version that resolves this vulnerability.Fixed in 1.2.6-9.oe2403sp1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Hosts running the rpcbind service are exposed because the service records previously unseen RPC statistics in unbounded in-memory lists. The attacker can reach the vulnerable service remotely.
Does exploitation require authentication or user interaction?
No. A remote attacker can trigger the denial of service without authentication or user interaction by sending a large number of unique requests.
What is the operational impact of a successful attack?
Memory consumption can grow persistently and CPU usage can increase, degrading service availability or exhausting it entirely.