CVE-2026-94640: Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-10-30
Weakness: CWE-400

Description

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions — fixed in 0:1.2.7-3.el10_2.1
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.2.5-11.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.2.6-7.el9_8.1
Red Hat OpenShift Container Platform 4.22: all versions — fixed in 4.22.9.8.202610241758-0
Red Hat OpenShift Container Platform 5: all versions

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:1.2.7-3.el10_2.1; Red Hat Enterprise Linux 8 0:1.2.5-11.el8_10; Red Hat Enterprise Linux 9 0:1.2.6-7.el9_8.1; Red Hat OpenShift Container Platform 4.22 4.22.9.8.202610241758-0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-94640 or the next vulnerability affects your stack