Skip to content
OpenAdvisories
High RHSA-2026:80501 7 CVEs

Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement update

Published Oct 14, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream bind9.16 32:9.16.23-0.7.el8_6.11
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream bind9.16-libs 32:9.16.23-0.7.el8_6.11
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream bind9.16 32:9.16.23-0.7.el8_6.11
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream bind9.16-libs 32:9.16.23-0.7.el8_6.11

Vulnerabilities 7

  • High 8.6
    CVE-2026-13321

    DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

    The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1,…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-11331

    Potential wildcard CNAME RPZ policy bypass

    An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-11622

    Potential memory usage beyond configured limits

    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage c…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-11721

    Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, wh…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-13204

    Unexpected exit in certain situations with NSEC and NSEC3 both present

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-3039

    BIND 9 server memory exhaustion during GSS-API TKEY negotiation

    BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • Medium 6.8
    CVE-2026-10723

    Incorrect acceptance of NSEC3 records

    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479767
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2503721
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504298
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504560
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80501.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-3039
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-3039
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-3039
  • report
    https://access.redhat.com/security/cve/CVE-2026-10723
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10723
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10723
  • report
    https://access.redhat.com/security/cve/CVE-2026-11331
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11331
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11331
  • report
    https://access.redhat.com/security/cve/CVE-2026-11622
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11622
  • report
    https://access.redhat.com/security/cve/CVE-2026-11721
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11721
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11721
  • report
    https://access.redhat.com/security/cve/CVE-2026-13204
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13204
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13204
  • report
    https://access.redhat.com/security/cve/CVE-2026-13321
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13321
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13321