Hi,

The following vulnerability was published for rpcbind.

CVE-2026-94640[0]:
| A flaw was found in rpcbind. This vulnerability allows a remote,
| unauthenticated attacker to cause a Denial of Service (DoS) by
| sending a large number of unique requests. The rpcbind service
| records previously unseen RPC (Remote Procedure Call) statistics in
| unbounded in-memory lists, leading to persistent memory growth and
| increased CPU usage. This can degrade or exhaust service
| availability.

At time of writing this bugreport I think we only have the Red Hat
bugzilla entry at hand.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-94640
https://www.cve.org/CVERecord?id=CVE-2026-94640
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2462960

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore