Summary
[32:9.11.36-16.8]
- Fix GSS-API resource leak (CVE-2026-3039)
- Invalid handling of CLASS != IN (CVE-2026-5946)
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bind | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-chroot | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-devel | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-export-devel | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-export-libs | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-libs | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-libs-lite | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-license | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-lite-devel | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-pkcs11 | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-pkcs11-devel | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-pkcs11-libs | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-pkcs11-utils | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-sdb | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-sdb-chroot | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | bind-utils | 32:9.11.36-16.el8_10.8 |
| Oracle Linux · 8 | python3-bind | 32:9.11.36-16.el8_10.8 |
Vulnerabilities 2
-
High 7.5
BIND 9 server memory exhaustion during GSS-API TKEY negotiation
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…
-
High 7.5
Invalid handling of CLASS != IN
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…