A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rpcbind | Oct 18, 2026 | Oct 15, 2026 |
| Amazon Linux Ami 2 | — | Upgrade rpcbindUpgrade rpcbind-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade rpcbind-debugsourceUpgrade rpcbindUpgrade rpcbind-debuginfo | Oct 13, 2026 | Sep 22, 2026 |
| Oracle_linux | — | Upgrade rpcbind | Oct 22, 2026 | Sep 22, 2026 |
| Redhat_linux | — | Upgrade rpcbind-debugsourceUpgrade rpcbind-debuginfoUpgrade rpcbindNo solution exists | Sep 24, 2026 | Jul 22, 2026 |
| Rocky_linux | — | Upgrade rpcbindUpgrade rpcbind-debugsourceUpgrade rpcbind-debuginfo | Oct 19, 2026 | Oct 16, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub