CVE-2026-39155

A flaw was found in Knot DNS. The mod-onlinesign component incorrectly computes the next NSEC Next Secure owner name. This can lead to an overly broad authenticated denial interval, allowing DNS Domain Name System resolvers that use aggressive negative caching to incorrectly generate negative...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bind (UTSA-2026-102693)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102693 advisory. If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bind (UTSA-2026-102699)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102699 advisory. The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

AlmaLinux 9 : bind9.18 (ALSA-2026:55442)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55442 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103695)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103695 advisory. If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103697)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103697 advisory. The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.12 (AXSA:2026-1555:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1555:03 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

bind security update

An update is available for bind. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...

RLSA-2026:55437 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RLSA-2026:55442 Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

ANT-2026-QRYCJNAP · dnsmasq · Denial-of-service

denial-of-service medium CVE-2026-13002 CVE-2026-4890 Severity Claude high · Security research firm high · Maintainer medium Discovered by an unreleased Anthropic model REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-QRYCJNAP:...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...