CVE catalog

CVE-2026-94640

rpcbind: CVE-2026-94640

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrpcbindsid1.2.7-1vulnerable
Debianrpcbindforky1.2.7-1vulnerable
Debianrpcbindtrixie1.2.7-1vulnerable
Debianrpcbindbookworm1.2.6-6vulnerable
Suserpcbindlinux enterprise server 12 sp5-ltss0.2.3-24.18.1fixed
Suserpcbindlinux enterprise server ltss extended security 12 sp50.2.3-24.18.1fixed
Suserpcbindlinux enterprise server 16.01.2.9-160000.3.1fixed
Suserpcbindlinux enterprise server for sap applications 16.01.2.9-160000.3.1fixed
Suserpcbindlinux micro 6.21.2.9-160000.3.1fixed
Opensuserpcbindleap 16.01.2.9-160000.3.1fixed
Opensuserpcbindtumbleweed1.2.9-3.1fixed
Suserpcbindlinux micro 6.01.2.9-159998.1.1fixed
Suserpcbindlinux micro 6.11.2.9-slfo.1.1_3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrpcbindsourcesid(unfixed)not yet assignedNot reported[1148730]
Debianrpcbindsourceforky(unfixed)not yet assignedNot reported[1148730]
Debianrpcbindsourcetrixie(unfixed)not yet assignedNot reported[1148730]
Debianrpcbindsourcebookworm(unfixed)not yet assignedNot reported[1148730]
Suserpcbindrpmlinux enterprise server 12 sp5-ltss0.2.3-24.18.1Not reportedSUSE-SU-2026:4446-1Not reported
Suserpcbindrpmlinux enterprise server ltss extended security 12 sp50.2.3-24.18.1Not reportedSUSE-SU-2026:4446-1Not reported
Suserpcbindrpmlinux enterprise server 16.01.2.9-160000.3.1Not reportedSUSE-SU-2026:23946-1Not reported
Suserpcbindrpmlinux enterprise server for sap applications 16.01.2.9-160000.3.1Not reportedSUSE-SU-2026:23946-1Not reported
Suserpcbindrpmlinux micro 6.21.2.9-160000.3.1Not reportedSUSE-SU-2026:23959-1Not reported
Opensuserpcbindrpmleap 16.01.2.9-160000.3.1Not reportedOPENSUSE-SU-2026:21975-1Not reported
Opensuserpcbindrpmtumbleweed1.2.9-3.1Not reportedOPENSUSE-SU-2026:11929-1Not reported
Suserpcbindrpmlinux micro 6.01.2.9-159998.1.1Not reportedSUSE-SU-2026:24320-1Not reported
Suserpcbindrpmlinux micro 6.11.2.9-slfo.1.1_3.1Not reportedSUSE-SU-2026:24275-1Not reported

[Debian bug #1148730]

Notes

[bookworm] rpcbind: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rpcbind]Affected

    Source package: [rpcbind]

    Details (2)

    • 1.2.6-6+b1 · amd64 · bookworm

      Affected

      dsa · rpcbind · debian · bookworm

    • 1.2.6-6+b1 · arm64 · bookworm

      Affected

      dsa · rpcbind · debian · bookworm

[openSUSE Tumbleweed]

  • [rpcbind]Affected

    Source package: [rpcbind]

    Details (1)

    • 1.2.9-1.3 · x86_64 · tumbleweed

      Affected · Fixed: 1.2.9-3.1

      dsa · rpcbind · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]