A vulnerability in rpcbind allows remote unauthenticated attackers to cause a Denial of Service (DoS) by sending many unique RPC requests. The service records these requests in unbounded in-memory lists, leading to memory exhaustion and high CPU usage, which degrades or exhausts service availability. This issue affects rpcbind versions prior to 1.2.6-9.oe2403sp1 and has been assigned CVE-2026-94640. A fix is available in version 1.2.6-9.oe2403sp1.