OESA-2026-4688

    Dashboard / Vulnerabilities / OESA-2026-4688

    OESA-2026-4688

    Published: 4 Nov 2026Last Modified: 4 Nov 2026
    Upstream:
    CVE-2026-94640

    Summary: rpcbind security update

    Details: The utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es): A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.(CVE-2026-94640)

    References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4688, https://nvd.nist.gov/vuln/detail/CVE-2026-94640

    Affected packages

    Package

    Name: rpcbind

    Purl: pkg:rpm/openEuler/rpcbind&distro=openEuler-24.03-LTS-SP3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.2.6-9.oe2403sp3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2026-4688 | CVE-DB