Skip to content
OpenAdvisories
High ELSA-2026-93925 3 CVEs

Important: bind security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 2, 2026 · Updated Nov 2, 2026

Ecosystem: Oracle Linux

Summary

[32:9.11.36-18]
- CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG
UDP message replay

[32:9.11.36-17]
- CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages
processing of crafted DNS messages

[32:9.11.36-16.17]
- Backport additional checks for the RDATASET_ATTR_ANCIENT flag when
looking for rdatasetheaders. Functions find_deepest_zonecut() and
cache_findzonecut() would otherwise pickup headers with the ancient
flag set, which other threads may attempt to free in the timespan between
unlocking the read lock and locking the write lock, causing
need_header_update() and update_header() to work with invalidated data.
(RHEL-257162)
- Fix CVE-2026-19662. The patch for CVE-2026-11622, which added reference
counting to rdatasetheaders within rbtdb, introduced a regression where
under certain timing conditions concurrent recursive queries could cause
named to crash due to use-after-free.

Fixed packages 17

ReleasePackageFixed in
Oracle Linux · 8 bind 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-chroot 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-devel 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-export-devel 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-export-libs 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-libs 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-libs-lite 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-license 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-lite-devel 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-pkcs11 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-pkcs11-devel 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-pkcs11-libs 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-pkcs11-utils 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-sdb 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-sdb-chroot 32:9.11.36-18.el8_10
Oracle Linux · 8 bind-utils 32:9.11.36-18.el8_10
Oracle Linux · 8 python3-bind 32:9.11.36-18.el8_10

Vulnerabilities 3

  • High 8.1
    CVE-2026-94300 Public exploit

    Concurrent GSS-TSIG messages corrupt memory

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19630

    Amplified resource exhaustion in inbound message processing

    In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amo…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-19662

    qpcache NOQNAME proof use-after-free crashes recursive resolver

    An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi