CLSA-2026-1790583590 bind: Fix of 3 CVEs

CVE-2026-19666: clear the NOQNAME proof alias on the DNS64 filter64 path in queryfind, so queryaddnoqnameproof no longer dereferences the rdataset that queryfilter64 has already returned to the message rdataset pool - CVE-2026-19667: reject negative cache records that do not fit in a dnsrdatat;...

CLSA-2026-1787754092 bind: Fix of 2 CVEs

CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...

bind: Fix of 2 CVEs

CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

...

CVE-2002-0400

The CVE-2002-0400 issue affects ISC BIND 9 up to 9.2.0 (pre-9.2.1). A remote attacker can cause a DoS shutdown by sending a malformed DNS packet that triggers an internal error in dns_message_findtype() when the rdataset parameter is not NULL. Impact is denial of service (availability impact: par...