Summary
[9.16.23-40.0.1.el9_8.10]
- Fix warning when changing device file permissions [Orabug: 36518580]
[32:9.16.23-40.10]
- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)
- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)
- Reject oversized negative cached records early (CVE-2026-19667)
[32:9.16.23-40.9]
- Add new root key 38696 into package files (RHEL-255763)
- Update built-in anchors in delv and named
[32:9.16.23-40.8]
- Fix NSEC3 signer validation (CVE-2026-10723)
[32:9.16.23-40.7]
- Fix CVE-2026-13321: reject out-of-zone NSEC next owner names
[32:9.16.23-40.6]
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
[32:9.16.23-40.5]
- Fix dns_rdataset_addnoqname() accepting unsigned NSEC/NSEC3
(CVE-2026-13204)
[32:9.16.23-40.4]
- Fix dnssec-signzone and RRSIG wildcard validation (CVE-2026-11721)
[32:9.16.23-40.3]
- Prevent cache memory exhaustion under sustained attack
(CVE-2026-11622, RHEL-213397)
[32:9.16.23-40.2]
- Fix GSS-API resource leak (CVE-2026-3039)
- Invalid handling of CLASS != IN (CVE-2026-5946)
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bind | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-chroot | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-devel | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-dnssec-doc | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-dnssec-utils | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-doc | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-libs | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-license | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | bind-utils | 32:9.16.23-40.0.1.el9_8.10 |
| Oracle Linux · 9 | python3-bind | 32:9.16.23-40.0.1.el9_8.10 |
Vulnerabilities 3
-
High 7.5
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…
-
High 7.5
Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…
-
High 7.5
Validating resolver can abort while caching a mismatched NOQNAME proof
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…