CVE-2026-94640
Discovered by AISLEPUBLISHEDCWE-400
Description
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
CVSS Base Scores
CVSS v3.1(Primary)
7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:1.2.7-3.el10_2.1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 8 | 0:1.2.5-11.el8_10 | unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | 0:1.2.6-7.el9_8.1 | unaffected |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 4.22.9.8.202610241758-0 | unaffected |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Credits
- This issue was discovered by Found by AISLE in partnership with Red Hat.