Skip to content
OpenAdvisories
High ELSA-2026-23360 2 CVEs

Important: bind9.16 security update (Oracle Linux 8)

Published Jun 4, 2026 · Updated Jun 4, 2026

Ecosystem: Oracle Linux

Summary

[32:9.16.23-0.22.6]
- Fix GSS-API resource leak (CVE-2026-3039)
- Invalid handling of CLASS != IN (CVE-2026-5946)

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 8 bind9.16 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-chroot 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-devel 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-dnssec-utils 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-doc 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-libs 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-license 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 bind9.16-utils 32:9.16.23-0.22.el8_10.6
Oracle Linux · 8 python3-bind9.16 32:9.16.23-0.22.el8_10.6

Vulnerabilities 2

  • High 7.5
    CVE-2026-3039

    BIND 9 server memory exhaustion during GSS-API TKEY negotiation

    BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-5946

    Invalid handling of CLASS != IN

    Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine