Skip to content
OpenAdvisories
High ELSA-2026-79162 3 CVEs

Important: bind security update (Oracle Linux 8)

Published Oct 8, 2026 · Updated Oct 8, 2026

Ecosystem: Oracle Linux

Summary

[32:9.11.36-16.16]
- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)
- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)
- Reject oversized negative cached records early (CVE-2026-19667)

Fixed packages 17

ReleasePackageFixed in
Oracle Linux · 8 bind 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-chroot 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-devel 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-export-devel 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-export-libs 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-libs 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-libs-lite 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-license 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-lite-devel 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-pkcs11 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-pkcs11-devel 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-pkcs11-libs 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-pkcs11-utils 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-sdb 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-sdb-chroot 32:9.11.36-16.el8_10.16
Oracle Linux · 8 bind-utils 32:9.11.36-16.el8_10.16
Oracle Linux · 8 python3-bind 32:9.11.36-16.el8_10.16

Vulnerabilities 3

  • High 7.5
    CVE-2026-19666

    Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19667

    Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

    If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80274

    Validating resolver can abort while caching a mismatched NOQNAME proof

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi