ALAS2027-2026-182

References: CVE-2026-16461  CVE-2026-94640  CVE-2026-16277 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-94640:
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

CVE-2026-16461:
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint could experience a crash or denial of service of the rpcinfo client.

CVE-2026-16277:
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this flaw to crash the rpcinfo client, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Issue Correction:
Run dnf update rpcbind or dnf update --advisory ALAS2027-2026-182 to update your system.

New Packages:

aarch64:
    rpcbind-debugsource-1.3.1-1.amzn2027.aarch64
    rpcbind-debuginfo-1.3.1-1.amzn2027.aarch64
    rpcbind-1.3.1-1.amzn2027.aarch64

src:
    rpcbind-1.3.1-1.amzn2027.src

x86_64:
    rpcbind-debugsource-1.3.1-1.amzn2027.x86_64
    rpcbind-debuginfo-1.3.1-1.amzn2027.x86_64
    rpcbind-1.3.1-1.amzn2027.x86_64