Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerability (USN-8696-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8696-1 advisory. It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-4202)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-4304)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

bind security update

32:9.11.36-16.16 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized negative cached records early CVE-2026-19667...

bind9.16 security, bug fix, and enhancement update

32:9.16.23-0.22-16 - Backport 'Do not use headerprev in expirelruheaders' from upstream. 32:9.16.23-0.22-15 - Reenable unit tests during build 32:9.16.23-0.22.14 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NS...

EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3965)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is...

CentOS Linux 8 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1785161562)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1785161562 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786523775)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786523775 advisory. - To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses...

OESA-2026-4190 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: If a BIN...

CentOS Linux 8.4 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1785161263)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1785161263 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...

CentOS Linux 8.5 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1785266647)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1785266647 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787754092)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787754092 advisory. - A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage...

CentOS Linux 8 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS-STREAM8:CLSA-2026:1785309449)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1785309449 advisory. - If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these...

SUSE CVE-2026-19941

An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0...

SUSE CVE-2026-80274

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions...

CVE-2026-19941

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...