CVE-2026-19630 Amplified resource exhaustion in inbound message processing

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

CVE-2026-19630

The BIND resolver is vulnerable to an amplified resource exhaustion attack due to how it handles inbound DNS protocol messages. Specifically, messages with a particular structure trigger additional processing without imposed limits. A maliciously crafted message containing a large number of these...

CVE-2026-19630 Amplified resource exhaustion in inbound message processing

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

EUVD-2026-107252

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

CVE-2026-19630

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

CVE-2026-19630

creationtimestamp| type| source ---|---|--- 2026-10-21 08:36:39+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-isc-bind-9-1 2026-10-21 11:48:12+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072 2026-10-21 17:58:31+00:00| seen|...

CVE-2026-94300

creationtimestamp| type| source ---|---|--- 2026-10-21 08:36:39+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-isc-bind-9-1 2026-10-21 11:48:12+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072 2026-10-21 17:59:11+00:00| seen|...

CVE-2026-96888

creationtimestamp| type| source ---|---|--- 2026-10-21 08:36:39+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-isc-bind-9-1 2026-10-21 11:48:12+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072 2026-10-21 17:59:52+00:00| seen|...

CVE-2026-97313

creationtimestamp| type| source ---|---|--- 2026-10-21 08:36:39+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-isc-bind-9-1 2026-10-21 11:48:12+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/isc-bind-security-advisory-av26-1072 2026-10-21 18:01:53+00:00| seen|...

Fedora 43 : bind / bind-dyndb-ldap (2026-aba85b9a89)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-aba85b9a89 advisory. Security updates using git snapshot Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained git...

RockyLinux 8 : bind (RLSA-2026:79162)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79162 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

Amazon Linux 2 : bind (ALAS-2026-4001)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4001 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation...

RHEL 8 : bind9.16 (RHSA-2026:79113)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79113 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

Red Hat: CVE-2026-96888: bind: bind: Denial of Service via assertion failure during redirect processing

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792588358)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792588358 advisory. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the...

RockyLinux 8 : bind9.16 (RLSA-2026:79113)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79113 advisory. bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19667 bind: BIND: Denial of Service via...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792590954)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792590954 advisory. - An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at...

Red Hat: CVE-2026-19630: bind: BIND: Denial of Service via unbounded processing of crafted DNS messages

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during...

Red Hat: CVE-2026-94300: bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially...

Red Hat: CVE-2026-97313: bind: bind: Denial of service via assertion failure in RPZ query processing

A recursive BIND server that receives a query with recursion desired RD=1 followed by a non-recursive query RD=0 may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one wit...