rpcbind vulnerabilities
4 known CVE vulnerabilities in rpcbind, translated and rated.
- CVE-2015-7236High
A use-after-free vulnerability in the xprt_set_caller function in rpcb_svc_com.c in rpcbind version 0.2.1 and earlier allows remote attackers to cause a daemon crash via crafted packets involving a PMAP_CALLIT code.
- CVE-2026-16461Medium
A stack-based buffer overflow was found in rpcinfo utility from rpcbind. In short mode (rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking.
- CVE-2026-16277Medium
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- CVE-1999-0461High
Versions of rpcbind, including Linux, IRIX, and Wietse Venema's rpcbind, allow a remote attacker to insert and delete entries by spoofing a source address.