Red Hat Security Advisory: bind security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 8

• High 8.6
  CVE-2026-13321

  DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

  The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1,…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Jul 22, 2026
• High 8.1
  CVE-2026-94300 Public exploit

  Concurrent GSS-TSIG messages corrupt memory

  Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 21, 2026
• High 7.5
  CVE-2026-11622

  Potential memory usage beyond configured limits

  A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage c…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Jul 22, 2026
• High 7.5
  CVE-2026-11721

  Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

  It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, wh…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Jul 22, 2026
• High 7.5
  CVE-2026-13204

  Unexpected exit in certain situations with NSEC and NSEC3 both present

  If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Jul 22, 2026
• High 7.5
  CVE-2026-19630

  Amplified resource exhaustion in inbound message processing

  In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amo…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 21, 2026
• High 7.5
  CVE-2026-3039

  BIND 9 server memory exhaustion during GSS-API TKEY negotiation

  BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  May 20, 2026
• High 7.5
  CVE-2026-5946

  Invalid handling of CLASS != IN

  Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  May 20, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2504166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2504298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2504338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2504447
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2556406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2556407
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95727.json
• report
  https://access.redhat.com/security/cve/CVE-2026-3039
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3039
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3039
• report
  https://access.redhat.com/security/cve/CVE-2026-5946
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5946
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5946
• report
  https://access.redhat.com/security/cve/CVE-2026-11622
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11622
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11622
• report
  https://access.redhat.com/security/cve/CVE-2026-11721
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11721
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11721
• report
  https://access.redhat.com/security/cve/CVE-2026-13204
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13204
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13204
• report
  https://access.redhat.com/security/cve/CVE-2026-13321
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13321
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13321
• report
  https://access.redhat.com/security/cve/CVE-2026-19630
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19630
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19630
• article
  https://kb.isc.org/docs/cve-2026-19630
• report
  https://access.redhat.com/security/cve/CVE-2026-94300
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-94300
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-94300
• article
  https://kb.isc.org/docs/cve-2026-94300