Vendor
CVE-2026-94640 allows a remote, unauthenticated attacker to trigger a denial of service in the rpcbind service through the submission of a flood of unique RPC requests that exhaust system memory.