Skip to content
OpenAdvisories
High USN-8696-1 1 CVE

bind9 vulnerability

Published Aug 31, 2026 · Updated Aug 31, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Bind incorrectly handled DNSSEC validation when a
domain was covered by both NSEC and NSEC3 records with only one type having
an RRSIG. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS bind9 1:9.18.39-0ubuntu0.22.04.6
Ubuntu · 24.04 LTS 24.04:LTS bind9 1:9.18.39-0ubuntu0.24.04.7
Ubuntu · 26.04 LTS 26.04:LTS bind9 1:9.20.24-1ubuntu0.3

Vulnerabilities 1

  • High 7.5
    CVE-2026-13204

    Unexpected exit in certain situations with NSEC and NSEC3 both present

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-13204