Skip to content
OpenAdvisories
High RHSA-2026:68279 14 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 bind 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-chroot 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-devel 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-dnssec-utils 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-doc 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-libs 32:9.20.29-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 bind-utils 32:9.20.29-0.1.hum1

Vulnerabilities 14

  • High 7.5
    CVE-2026-19666

    Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19667

    Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

    If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-76163

    named aborts on a TKEY query when the user configuration has no global options statement

    If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-77692

    Unauthenticated remote crash of named via a single DoH SIG(0) request

    An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-80274

    Validating resolver can abort while caching a mismatched NOQNAME proof

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-81563

    SVCB AliasMode additional-data error leaks qpcache references

    A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from per…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-81736

    Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

    If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2026-19033

    Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

    For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signatur…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-19662

    qpcache NOQNAME proof use-after-free crashes recursive resolver

    An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-19941

    checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof

    An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-77119

    NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

    A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • Medium 5.8
    CVE-2026-78301

    Out-of-zone database nodes can become authoritative zone cuts

    A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose a…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-19668

    Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching

    A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affe…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-75029

    Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

    In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-81736
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-76163
  • report
    https://access.redhat.com/security/cve/CVE-2026-78301
  • report
    https://access.redhat.com/security/cve/CVE-2026-75029
  • report
    https://access.redhat.com/security/cve/CVE-2026-80274
  • report
    https://access.redhat.com/security/cve/CVE-2026-81563
  • report
    https://access.redhat.com/security/cve/CVE-2026-77692
  • report
    https://access.redhat.com/security/cve/CVE-2026-19666
  • report
    https://access.redhat.com/security/cve/CVE-2026-19668
  • report
    https://access.redhat.com/security/cve/CVE-2026-19033
  • report
    https://access.redhat.com/security/cve/CVE-2026-19662
  • report
    https://access.redhat.com/security/cve/CVE-2026-19667
  • report
    https://access.redhat.com/security/cve/CVE-2026-19941
  • report
    https://access.redhat.com/security/cve/CVE-2026-77119
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68279.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535479
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19033
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19033
  • article
    https://downloads.isc.org/isc/bind9/9.20.29
  • article
    https://downloads.isc.org/isc/bind9/9.21.26
  • article
    https://kb.isc.org/docs/cve-2026-19033
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535445
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19662
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19662
  • article
    https://kb.isc.org/docs/cve-2026-19662
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535477
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19666
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19666
  • article
    https://kb.isc.org/docs/cve-2026-19666
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535435
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19667
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19667
  • article
    https://kb.isc.org/docs/cve-2026-19667
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535476
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19668
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19668
  • article
    https://kb.isc.org/docs/cve-2026-19668