OESA-2026-4689: rpcbind security update
The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es):
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/rpcbindto a version that resolves this vulnerability.Fixed in 1.2.6-9.oe2403sp4
Event History
Frequently Asked Questions
Which systems are exposed to this denial-of-service issue?
Systems running the rpcbind service are exposed, because the service must be running to process RPC calls on the local machine. The issue is reachable remotely over the network.
Does exploitation require authentication or user interaction?
No. A remote attacker can exploit the flaw without authentication, privileges, or user interaction by sending many unique requests to rpcbind.
What is the expected impact of a successful attack?
Previously unseen RPC request statistics are retained in unbounded in-memory lists, causing persistent memory growth and increased CPU usage. This can degrade rpcbind availability or exhaust service resources.