NSEC3-X

DISCLAIMER: This project was generated by Artificial Intelligence AI but has undergone a rigorous "Human-in-the-Loop" HITL process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was...

NSEC3-Encloser-Attack

NSEC3-Encloser-Attack Zonefile Generation This project generates DNS zonefiles with custom NSEC3 parameters to reproduce and evaluate the attacks in CVE-2023-50868. Requirements Python3 tested on Python3.10 Installed Python dependencies: cryptography 42.0.5 dnspython 2.6.1 Components lib: Python...

K000163710: BIND vulnerability CVE-2026-10723

Security Advisory Description BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through...

USN-8929-1: Bind vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8648-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8648-1 advisory. It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerability (USN-8696-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8696-1 advisory. It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

EulerOS 2.0 SP13 : bind (EulerOS-SA-2026-4122)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue...

EulerOS 2.0 SP13 : bind (EulerOS-SA-2026-4031)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue...

EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-4213)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker...

Oracle Linux 8 : bind9.16 (ELSA-2026-79113)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-79113 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

Oracle Linux 8 : bind (ELSA-2026-79162)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-79162 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind9.16 security, bug fix, and enhancement update

32:9.16.23-0.22-16 - Backport 'Do not use headerprev in expirelruheaders' from upstream. 32:9.16.23-0.22-15 - Reenable unit tests during build 32:9.16.23-0.22.14 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NS...

bind security update

32:9.11.36-16.16 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized negative cached records early CVE-2026-19667...

EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3899)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is...

EulerOS 2.0 SP15 : bind (EulerOS-SA-2026-3965)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is...

bind security update

9.16.23-40.0.1.el98.10 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.10 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized...