SUSE CVE-2026-19667

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in named results in a negative cache entry of 0 bytes. When this entry is subsequently read, named aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 throug...

SUSE CVE-2026-75029

In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly...

SUSE CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

SUSE CVE-2026-77692

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

SUSE CVE-2026-81736

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through...

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium ISC has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS DoH. A sender with no credentials can crash the...

CVE-2026-19941

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...

CVE-2026-77119

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver,...

CVE-2026-19662

A flaw was found in BIND 9. A remote attacker can cause a named resolver to stop functioning Denial of Service by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive...

bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses

A flaw was found in BIND 9. A remote attacker can cause a named resolver to stop functioning Denial of Service by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive...

bind9: bind: BIND 9: DNSSEC bypass via NSEC3 insecure-referral proof

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver,...

bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response,...

bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling

A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...

bind: BIND 9: Denial of Service via crafted query responses

A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the named service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service DoS due to memory exhaustion...

bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...

DEBIAN-CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

ALPINE-CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

AZL-103341 CVE-2026-77119 affecting package bind 9.20.26-1

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through...

DEBIAN-CVE-2026-76163

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and...