Summary
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
* bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Bug Fix(es) and Enhancement(s):
* [BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 [rhel-10] (JIRA:Rocky Linux-142289)
* [rhel-10] Bind 9.18.33 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144421)
* bind: New root trust anchor key for DNSSEC [rhel-10.3] (JIRA:Rocky Linux-255748)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 46
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | bind | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-chroot | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-chroot | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-chroot | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-chroot | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debugsource | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debugsource | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debugsource | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-debugsource | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-devel | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-devel | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-devel | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-devel | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-dnssec-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-doc | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-libs-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-license | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils-debuginfo | 2:9.18.33-29.el10_3 |
| Rocky Linux · 10 | bind-utils-debuginfo | 2:9.18.33-29.el10_3 |
Vulnerabilities 2
-
Medium 5.3
Amplification vulnerabilities via self-pointed glue records
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.…
-
Medium 5.3CVE-2026-5950 Public exploit
Unbounded resend loop in BIND 9 resolver
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue…