diff --git a/packages/network/rpcbind/package.mk b/packages/network/rpcbind/package.mk
index fd537682cb..d4f23cce25 100644
--- a/packages/network/rpcbind/package.mk
+++ b/packages/network/rpcbind/package.mk
@@ -3,8 +3,8 @@
 # Copyright (C) 2018-present Team LibreELEC (https://libreelec.tv)
 
 PKG_NAME="rpcbind"
-PKG_VERSION="1.2.5"
-PKG_SHA256="2ce360683963b35c19c43f0ee2c7f18aa5b81ef41c3fdbd15ffcb00b8bffda7a"
+PKG_VERSION="1.2.6"
+PKG_SHA256="5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de"
 PKG_LICENSE="OSS"
 PKG_SITE="http://rpcbind.sourceforge.net/"
 PKG_URL="${SOURCEFORGE_SRC}/rpcbind/rpcbind/${PKG_VERSION}/${PKG_NAME}-${PKG_VERSION}.tar.bz2"
diff --git a/packages/network/rpcbind/patches/rpcbind-1.2.6-vulnerability_fixes-1.patch b/packages/network/rpcbind/patches/rpcbind-1.2.6-vulnerability_fixes-1.patch
new file mode 100644
index 0000000000..d8137d3c96
--- /dev/null
+++ b/packages/network/rpcbind/patches/rpcbind-1.2.6-vulnerability_fixes-1.patch
@@ -0,0 +1,29 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2017-05-29
+Initial Package Version: 0.2.4 (also affects earlier versions)
+Upstream Status: Unknown
+Origin: Guido Vranken
+Description: Fixes CVE-2017-8779 (DOS by remote attackers - memory consumption
+without subsequent free).
+
+diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
+index 5862c26..e11f61b 100644
+--- a/src/rpcb_svc_com.c
++++ b/src/rpcb_svc_com.c
+@@ -48,6 +48,7 @@
+ #include <rpc/rpc.h>
+ #include <rpc/rpcb_prot.h>
+ #include <rpc/svc_dg.h>
++#include <rpc/rpc_com.h>
+ #include <netconfig.h>
+ #include <errno.h>
+ #include <syslog.h>
+@@ -432,7 +433,7 @@ rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp /*__unused*/,
+ static bool_t
+ xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
+ {
+-	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
++	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), RPC_MAXDATASIZE));
+ }
+ 
+ /*