AlmaLinux 8 : bind (ALSA-2026:54654)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54654 advisory. bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-13321 bind: bind9: Potential memory usage beyond configured limits...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

OESA-2026-3331 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

OESA-2026-3330 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

ALSA-2026:54510 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RHEL 9 : bind (RHSA-2026:54510)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54510 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

bind9.16 security update

32:9.16.23-0.22.12 - Fix NSEC3 signer validation CVE-2026-10723 - Resolves: RHEL-213499 32:9.16.23-0.22.11 - Reject out-of-zone NSEC next owner names CVE-2026-13321 - Resolves: RHEL-213313 32:9.16.23-0.22.10 - Fix CVE-2026-11622: reference-counted DNS cache slab headers - Resolves: RHEL-213396...

bind security update

9.16.23-40.0.1.el98.8 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.8 - Fix NSEC3 signer validation CVE-2026-10723 32:9.16.23-40.7 - Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 32:9.16.23-40.6 - Fix RPZ name-too-long wildcard expansion...

ALSA-2026:54654 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind security update

32:9.11.36-16.14 - Validate NSEC3 signer matches owning zone CVE-2026-10723 32:9.11.36-16.12 - Prevent accepting unsigned NSEC/NSEC3 records CVE-2026-13204 32:9.11.36-16.11 - Reject out-of-zone NSEC entries in DNSSEC validation CVE-2026-13321 32:9.11.36-16.10 - Reject RRSIG records with invalid...

Important: bind9.16 security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind: bind9: Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...