Summary
BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.
Security Fix(es):
* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | bind9.18 | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-chroot | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-devel | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-dnssec-utils | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-doc | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-libs | 32:9.18.29-5.el9_7.4 |
| AlmaLinux · 9 | bind9.18-utils | 32:9.18.29-5.el9_7.4 |
Vulnerabilities 1
-
High 7.5
Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make re…