OESA-2026-4688: rpcbind security update
The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es):
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpcbindto a version that resolves this vulnerability.Fixed in 1.2.6-9.oe2403sp3
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when the rpcbind service is running and reachable by a remote attacker. The issue is in rpcbind's handling of previously unseen RPC request statistics.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They can trigger the denial of service remotely by sending a large number of unique requests.
What is the expected security impact?
The impact is availability loss: unbounded in-memory statistic lists can cause persistent memory growth and increased CPU usage, degrading or exhausting service availability. The supplied vector indicates no confidentiality or integrity impact.