Skip to content
OpenAdvisories
High ALSA-2026:75578 5 CVEs

Important: bind9.18 security update

Published Oct 5, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

* bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736)
* bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)
* bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563)
* bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
* bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 7

ReleasePackageFixed in
AlmaLinux · 9 bind9.18 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-chroot 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-devel 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-dnssec-utils 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-doc 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-libs 32:9.18.29-14.el9_8.10
AlmaLinux · 9 bind9.18-utils 32:9.18.29-14.el9_8.10

Vulnerabilities 5

  • High 7.5
    CVE-2026-19666

    Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19667

    Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

    If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80274

    Validating resolver can abort while caching a mismatched NOQNAME proof

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-81563

    SVCB AliasMode additional-data error leaks qpcache references

    A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from per…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-81736

    Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

    If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-19666
  • report
    https://access.redhat.com/security/cve/CVE-2026-19667
  • report
    https://access.redhat.com/security/cve/CVE-2026-80274
  • report
    https://access.redhat.com/security/cve/CVE-2026-81563
  • report
    https://access.redhat.com/security/cve/CVE-2026-81736
  • report
    https://bugzilla.redhat.com/2535432
  • report
    https://bugzilla.redhat.com/2535435
  • report
    https://bugzilla.redhat.com/2535461
  • report
    https://bugzilla.redhat.com/2535466
  • report
    https://bugzilla.redhat.com/2535477
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-75578.html