EulerOS Virtualization 2.11.1 : bind (EulerOS-SA-2026-3402)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a special...

AZL-102044 CVE-2026-93084 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

K000163335: BIND vulnerability CVE-2026-11622

Security Advisory Description A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be...

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium ISC has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS DoH. A sender with no credentials can crash the...

F5 Networks BIG-IP : BIND vulnerability (K000163335)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163335 advisory. A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from...

CVE-2026-19941

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...

CVE-2026-77119

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver,...

CVE-2026-19662

A flaw was found in BIND 9. A remote attacker can cause a named resolver to stop functioning Denial of Service by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive...

bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response,...

bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...

bind: BIND: Denial of Service via TKEY query with specific configuration

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending a specially crafted TKEY query to a BIND server configured without a global 'options' block in its 'named.conf' file. This can lead to an assertion failure, causing the BIND program to unexpectedly terminate. Th...

bind: BIND: DNS cache poisoning via malformed zone insertion

A flaw was found in BIND, a widely used Domain Name System DNS software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own...

bind9: bind: BIND 9: DNSSEC bypass via NSEC3 insecure-referral proof

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver,...

bind: BIND: Denial of Service via invalid DNSSEC records

A flaw was found in BIND, a widely used Domain Name System DNS software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC Domain Name System Security Extensions records to a BIND recursive resolver. This could lead to excessive...

bind: BIND 9: Denial of Service via crafted query responses

A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the named service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service DoS due to memory exhaustion...

bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas

A flaw was found in bind. A remote attacker without a valid TSIG Transaction Signature can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR Incremental Zone Transfer. The named process may apply this unauthenticated data before the TSIG signature is verified. ...

bind: BIND: Denial of Service via crafted DNSSEC reply

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service DoS for the affected BIND resolver...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: bind: bind-9.20.29-0.1.hum1 aarch64, x8664 bind-chroot-9.20.29-0.1.hum1 aarch64, x8664 bind-devel-9.20.29-0.1.hum1 aarch64, x8664 bind-dnssec-utils-9.20.29-0.1.hum1 aarch64, x8664...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...

bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling

A flaw was found in bind9's named component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When named attempts to read this invalid...