bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

OESA-2026-3331 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

OESA-2026-3291 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

OESA-2026-3290 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CLSA-2026-1785888218 unbound: Fix of 11 CVEs

CVE-2026-46582: mark a wildcard-expanded rrset bogus in the cache when the wildcard proof fails, so a replayed wildcard rrset is not served as secure - CVE-2026-40691: bound the DNSCrypt reply length against the destination buffer capacity on the TCP path - CVE-2026-42955: clamp the TTL of...

Amazon Linux 2 : bind, --advisory ALAS2-2026-3854 (ALAS-2026-3854)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3854 advisory. BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMA...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-2040)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2040 advisory. BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.This issue affects BIND 9 versions 9.18.0 through 9.18.50,...

Important: bind

Issue Overview: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and...

CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

PT-2026-66794

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is url safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure due to the use of 0.0.0.0 instead of NXDOMAIN in block responses. An attacker can cause unintended network traffic to be sent to localhost by triggering blocked DNS queries. Remediation Upgrade...

PT-2026-69244

Summary 0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped. Impact Unintended traffic could be sent to localhost. Impact depends on running services and firewall rules...

CLSA-2026-1785266647 bind: Fix of 2 CVEs

CVE-2026-10723: reject child-zone NSEC3 records whose signer does not match the owning zone apex, preventing forged authenticated NXDOMAIN responses - CVE-2026-13321: reject signed NSEC records whose Next Domain Name points outside the signer's zone, preventing cross-zone DNSSEC cache poisoning...

CLSA-2026-1785161263 bind: Fix of 2 CVEs

CVE-2026-10723: reject child-zone NSEC3 records whose signer does not match the owning zone apex, preventing forged authenticated NXDOMAIN responses - CVE-2026-13321: reject signed NSEC records whose Next Domain Name points outside the signer's zone, preventing cross-zone DNSSEC cache poisoning...

Linux Distros Unpatched Vulnerability : CVE-2026-10723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9...

Linux Distros Unpatched Vulnerability : CVE-2026-44687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be...

MGASA-2026-0288 Updated dnsmasq packages fix security vulnerabilities

The updated dnsmasq packages fix multiple security issues: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an...

Updated dnsmasq packages fix security vulnerabilities

The updated dnsmasq packages fix multiple security issues: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an...

CVE-2026-10723

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

AZL-93120 CVE-2026-10723 affecting package bind for versions less than 9.20.26-1

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through...