Moderate: bind9.18 security, bug fix, and enhancement update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

* bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)

* bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)

Bug Fix(es) and Enhancement(s):

* Bind 9.18.29 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144422)

* [BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 (JIRA:Rocky Linux-86172)

* bind9.18: New root trust anchor key for DNSSEC [rhel-9.9] (JIRA:Rocky Linux-255678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.