PT-2026-93745

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1 Description A named resolver may...

CVE-2026-80274: Reachable Assertion

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions...

CVE-2026-19941: Insufficient Verification of Data Authenticity

An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0...

CVE-2026-19941: Insufficient Verification of Data Authenticity

An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0...

Linux Distros Unpatched Vulnerability : CVE-2026-19941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level...

Astra Linux – Vulnerability in unbound, bind9

The “Closest Encloser Proof” aspect of the DNS protocol as described in RFC 5155, when the guidance provided in RFC 9276 is skipped enables remote attackers to cause a denial of service resulting in high CPU usage for SHA-1 calculations through DNSSEC responses during a random subdomain attack,...

MGASA-2026-0399 Updated bind package fixes a security vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service CVE-2026-13204...

Updated bind package fixes a security vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service CVE-2026-13204...

K000163212: BIND vulnerability CVE-2026-13204

Security Advisory Description If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0...

F5 Networks BIG-IP : BIND vulnerability (K000163212)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.6 / 17.5.1.10 / 21.1.0.3. It is, therefore, affected by a vulnerability as referenced in the K000163212 advisory. If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there...

Alibaba Cloud Linux 3 : 0272: unbound (ALINUX3-SA-2026:0272)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0272 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-44690: In NLnet Labs Unbound 1.7.0 up to a...

USN-8696-1 bind9 vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service...

USN-8696-1: Bind vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service...

bind: Fix of 2 CVEs

CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...

MiracleLinux 9 : bind9.18-9.18.29-14.el9_8.8 (AXSA:2026-1671:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1671:05 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

TencentOS Server 3: unbound (TSSA-2026:0904)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0904 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104815 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-104836)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104836 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...