[ CVE-2026-94640 · Published 22 Sep 2026 ]
Vulnerability in Red Hat Enterprise Linux 10
CVSS 7.5
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-3979
Red Hat Enterprise Linux (rpcbind): Vulnerability allows denial of service Translated from German
[ References ]References
- access.redhat.com/errata/RHSA-2026:83561vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:83562vendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2026:83563vendor-advisoryx_refsource_REDHAT
- access.redhat.com/security/cve/CVE-2026-94640vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT