Skip to content
OpenAdvisories
High RHSA-2026:95478 12 CVEs

Red Hat Security Advisory: bind security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-libs-lite 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-pkcs11 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-pkcs11-libs 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-pkcs11-utils 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-sdb 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind-utils 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bind 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::baseos bind-export-libs 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-libs-lite 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-pkcs11 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-pkcs11-libs 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-pkcs11-utils 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-sdb 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind-utils 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bind 32:9.11.36-8.el8_8.11
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::baseos bind-export-libs 32:9.11.36-8.el8_8.11

Vulnerabilities 12

  • High 8.6
    CVE-2026-13321

    DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

    The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1,…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-94300 Public exploit

    Concurrent GSS-TSIG messages corrupt memory

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-11622

    Potential memory usage beyond configured limits

    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage c…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-11721

    Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, wh…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-13204

    Unexpected exit in certain situations with NSEC and NSEC3 both present

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-19630

    Amplified resource exhaustion in inbound message processing

    In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amo…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19666

    Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-19667

    Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

    If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-3039

    BIND 9 server memory exhaustion during GSS-API TKEY negotiation

    BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-5946

    Invalid handling of CLASS != IN

    Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-80274

    Validating resolver can abort while caching a mismatched NOQNAME proof

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.8
    CVE-2026-10723

    Incorrect acceptance of NSEC3 records

    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479767
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2479771
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504298
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2504560
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535435
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535466
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535477
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556406
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556407
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95478.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-3039
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-3039
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-3039
  • report
    https://access.redhat.com/security/cve/CVE-2026-5946
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-5946
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-5946
  • report
    https://access.redhat.com/security/cve/CVE-2026-10723
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-10723
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-10723
  • report
    https://access.redhat.com/security/cve/CVE-2026-11622
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11622
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11622
  • report
    https://access.redhat.com/security/cve/CVE-2026-11721
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11721
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11721
  • report
    https://access.redhat.com/security/cve/CVE-2026-13204
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13204
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13204
  • report
    https://access.redhat.com/security/cve/CVE-2026-13321
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-13321
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-13321
  • report
    https://access.redhat.com/security/cve/CVE-2026-19630
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19630
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19630
  • article
    https://kb.isc.org/docs/cve-2026-19630