Skip to content
OpenAdvisories
High ALAS2-2026-4038 2 CVEs

Important: bind security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-94300: Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. CVE-2026-19630: Inbound-message resource exhaustion (CWE-400) leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26.

Fixed packages 17

ReleasePackageFixed in
Amazon Linux · 2 bind 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-chroot 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-debuginfo 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-devel 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-export-devel 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-export-libs 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-libs 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-libs-lite 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-license 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-lite-devel 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-pkcs11 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-pkcs11-devel 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-pkcs11-libs 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-pkcs11-utils 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-sdb 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-sdb-chroot 32:9.11.4-26.P2.amzn2.13.20
Amazon Linux · 2 bind-utils 32:9.11.4-26.P2.amzn2.13.20

Vulnerabilities 2

  • High 8.1
    CVE-2026-94300 Public exploit

    Concurrent GSS-TSIG messages corrupt memory

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19630

    Amplified resource exhaustion in inbound message processing

    In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amo…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-19630.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-94300.html