Amazon Linux 2023 Security Advisory: ALAS2023-2026-3169
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
FAQs regarding Amazon Linux ALAS/CVE Severity
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2026-16277)
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client. (CVE-2026-16461)
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability. (CVE-2026-94640)
Affected Packages:
rpcbind
Issue Correction:
Run dnf update rpcbind --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3169 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
rpcbind-debugsource-1.2.6-0.amzn2023.0.3.aarch64
rpcbind-debuginfo-1.2.6-0.amzn2023.0.3.aarch64
rpcbind-1.2.6-0.amzn2023.0.3.aarch64
src:
rpcbind-1.2.6-0.amzn2023.0.3.src
x86_64:
rpcbind-debugsource-1.2.6-0.amzn2023.0.3.x86_64
rpcbind-debuginfo-1.2.6-0.amzn2023.0.3.x86_64
rpcbind-1.2.6-0.amzn2023.0.3.x86_64