Hi,

The following vulnerability was published for rpcbind.

CVE-2026-16277[0]:
| A stack-based buffer overflow was found in rpcbind's rpcinfo
| utility. When querying a remote rpcbind service with `rpcinfo -l`,
| address information returned by the server is copied into a fixed-
| size buffer without sufficient bounds checking. A malicious or
| compromised rpcbind server could use this flaw to crash the rpcinfo
| client, resulting in a denial of service. The highest threat from
| this vulnerability is to system availability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-16277
https://www.cve.org/CVERecord?id=CVE-2026-16277
[1] https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore