Skip to content
OpenAdvisories
Medium ELSA-2026-89746 1 CVE

Moderate: bind9.18 security update (Oracle Linux 9)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Oracle Linux

Summary

[32:9.18.29-14.11]
- Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 9 bind9.18 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-chroot 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-devel 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-dnssec-utils 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-doc 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-libs 32:9.18.29-14.el9_8.11
Oracle Linux · 9 bind9.18-utils 32:9.18.29-14.el9_8.11

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-19662

    qpcache NOQNAME proof use-after-free crashes recursive resolver

    An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi