ALSA-2026:54510 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind security update

9.16.23-40.0.1.el98.8 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.8 - Fix NSEC3 signer validation CVE-2026-10723 32:9.16.23-40.7 - Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 32:9.16.23-40.6 - Fix RPZ name-too-long wildcard expansion...

bind security update

32:9.11.36-16.14 - Validate NSEC3 signer matches owning zone CVE-2026-10723 32:9.11.36-16.12 - Prevent accepting unsigned NSEC/NSEC3 records CVE-2026-13204 32:9.11.36-16.11 - Reject out-of-zone NSEC entries in DNSSEC validation CVE-2026-13321 32:9.11.36-16.10 - Reject RRSIG records with invalid...

ALSA-2026:54654 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

dnsmasq DNSSEC NSEC/NSEC3 Type Bitmap Processing Infinite Loop Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of dnsmasq. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NSEC records. The issue results from a lack of a proper exit...

Important: Red Hat Security Advisory: ldns security update

An update for ldns is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

Black Hat Europe 2024 Conference Slides

Black Hat Europe 2024 conference slides for topics Vulnerabilities in the eSIM download protocol, WiFi Calling: Revealing Downgrade Attacks and Not-so-private private Keys, From Pass-the-Hash to Code Execution on Schneider Electric M340 PLCs, CodeCloak: A DRL-Based Method for Mitigating Code...

SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:3554-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3554-1 advisory. - CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-11331: potential wildcard CNAME...

RHEL 9 : ldns (RHSA-2026:54377)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54377 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define...

RHEL 10 : ldns (RHSA-2026:53402)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53402 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also defin...

Security update for bind

This update for bind fixes the following issues: CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. CVE-2026-11331: potential wildcard CNAME RPZ policy bypass bsc1271984. CVE-2026-11622: potential memory usage beyond configured limits bsc1271986. CVE-2026-11721: cache poisoning...

OPENSUSE-SU-2026:21550-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

SUSE-SU-2026:23050-1 Security update for unbound

This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in libngtcp2 for DNS-over-QUIC environments with high concurrency bsc1271879. - CVE-2026-32665: Remote DNS-over-QUIC denial of service due to quic-size budget...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-3058)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-3113)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

Security Bulletin: Vulnerability in Bind affects IBM Netezza Appliance

Summary The Bind package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-11605 Vulnerability Details CVEID:CVE-2026-11605 DESCRIPTION: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all...