Summary
Vitaly Simonovich discovered that Bind could exhaust memory during
GSS-API TKEY negotiation. A remote attacker could possibly use this
issue to cause Bind to use excessive resources, leading to a denial of
service. (CVE-2026-3039)
Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue
records. A remote attacker could possibly use this issue to use Bind in
denial of service amplification attacks against other systems.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2026-3592)
It was discovered that Bind incorrectly handled DNS messages whose
class was not IN. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-5946)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.19+esm14 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | bind9 | 1:9.10.3.dfsg.P4-8ubuntu1.19+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | bind9 | 1:9.11.3+dfsg-1ubuntu1.19+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | bind9 | 1:9.18.30-0ubuntu0.20.04.2+esm2 |
Vulnerabilities 3
-
High 7.5
BIND 9 server memory exhaustion during GSS-API TKEY negotiation
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integr…
-
High 7.5
Invalid handling of CLASS != IN
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafte…
-
Medium 5.3
Amplification vulnerabilities via self-pointed glue records
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.…