Description

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-22T16:18:18.143Z",
  "pubdate": "2026-09-22T16:18:18.143Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in rpcbind, the RPC bind utility responsible for mapping RPC services to universal addresses.\nThe vulnerability is classified as a Denial of Service (DoS) flaw caused by improper resource management of RPC statistics.\nA remote, unauthenticated attacker can exploit this by flooding the service with a high volume of unique RPC requests.\nThe flaw stems from the application's failure to bound the growth of in-memory lists used to track RPC statistics, leading to persistent memory consumption and CPU exhaustion.\nSuccessful exploitation results in the degradation or total unavailability of the rpcbind service, potentially impacting any network-dependent applications that rely on RPC mapping.\nThis vulnerability poses a significant risk to service availability, as it requires no prior authentication or administrative privileges to trigger.\nThe exposure is primarily driven by the public accessibility of the rpcbind service, allowing external actors to trigger memory growth remotely.",
  "technicalDetails": "The root cause of this vulnerability lies in the unbounded data structure management within the rpcbind daemon. When processing incoming RPC requests, the service attempts to record statistics for each unique request encountered.\nThe implementation utilizes dynamically allocated, in-memory linked lists or similar data structures to maintain these statistics. The critical failure is the lack of a defined maximum capacity (or cap) on these lists.\nAn unauthenticated attacker can craft a series of malicious, unique RPC requests. Because each request is perceived as 'previously unseen' by the rpcbind logic, the service allocates additional memory to store these new statistical entries.\nThe attack flow follows a repetitive pattern: the attacker sends a high frequency of distinct, spoofed, or otherwise unique RPC identifiers to the rpcbind service via the network. Upon receiving each unique request, the rpcbind daemon executes internal routines to instantiate a new record in its telemetry tracking structure.\nBecause the storage mechanism does not prune or limit the number of entries, the memory footprint of the rpcbind process expands indefinitely. As the memory consumption approaches system or process-specific limits, the operating system's memory management becomes a bottleneck, leading to increased latency in processing legitimate requests.\nFurthermore, the CPU overhead required to traverse, append, and maintain these ever-growing unbounded lists results in significant CPU cycle spikes. The accumulation of these effects leads to a degradation of service quality, eventually culminating in a state of Denial of Service (DoS) where the daemon is no longer capable of responding to legitimate network requests.\nThe vulnerability is inherently network-exposed, as the RPC portmapper functionality must be accessible for standard RPC communication, making it reachable to any attacker capable of establishing a connection to the port. Exploitation does not require authentication, as the mechanism is part of the initial request handling pipeline of the daemon.\nPost-exploitation, the service often reaches a state where it is effectively deadlocked or unable to allocate further resources, requiring an manual service restart to restore operational stability."
}