A vulnerability in rpcbind allows remote unauthenticated attackers to cause a denial of service by sending many unique RPC requests. The service maintains unbounded in-memory lists of previously unseen RPC statistics, causing memory growth and high CPU usage that can degrade or exhaust service availability. This flaw is fixed in rpcbind version 1.2.6-9.oe2403sp3.