Summary
[9.18.33-15.0.1.el10_2.12]
- Hard require needed openssl-libs [Orabug: 38742109]
- Fix warning when changing device file permissions [Orabug: 36518580]
[32:9.18.33-15.12]
- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)
- Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563)
- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)
- Reject oversized negative cached records early (CVE-2026-19667)
- Set limit to following HTTPS/SVCB aliases (CVE-2026-81736)
[32:9.18.33-15.11]
- Add new root key 38696 into package files too (RHEL-252999)
[32:9.18.33-15.10]
- Validate NSEC3 signer matches owning zone (CVE-2026-10723)
[32:9.18.33-15.9]
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)
[32:9.18.33-15.7]
- Fix reference-counted dns_slabheaders in cache (CVE-2026-11622)
[32:9.18.33-15.6]
- Fix RRSIG label count validation for wildcard cache poisoning
(CVE-2026-11721)
[32:9.18.33-15.5]
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
[32:9.18.33-15.4]
- Fix assertion failure on malformed NSEC/NSEC3 responses
(CVE-2026-13204)
[32:9.18.33-15.2]
- Fix GSS-API resource leak (CVE-2026-3039)
- Invalid handling of CLASS != IN (CVE-2026-5946)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | bind | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-chroot | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-devel | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-dnssec-utils | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-doc | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-libs | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-license | 32:9.18.33-15.0.1.el10_2.12 |
| Oracle Linux · 10 | bind-utils | 32:9.18.33-15.0.1.el10_2.12 |
Vulnerabilities 5
-
High 7.5
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…
-
High 7.5
Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…
-
High 7.5
Validating resolver can abort while caching a mismatched NOQNAME proof
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…
-
High 7.5
SVCB AliasMode additional-data error leaks qpcache references
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from per…
-
High 7.5
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…