Summary
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | bind | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-chroot | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-devel | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-dnssec-doc | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-dnssec-utils | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-doc | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-libs | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-license | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | bind-utils | 32:9.16.23-40.el9_8.2 |
| AlmaLinux · 9 | python3-bind | 32:9.16.23-40.el9_8.2 |
Vulnerabilities 2
-
High 7.5
BIND 9 server memory exhaustion during GSS-API TKEY negotiation
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…
-
High 7.5
Invalid handling of CLASS != IN
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…