Summary
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack. This issue
only affected Ubuntu 18.04 LTS. (CVE-2025-40778)
Samy Medjahed discovered that Bind incorrectly handled insecure delegation
validation. A remote attacker could possibly use this issue to cause
excessive NSEC3 iterations, consuming CPU resources, and leading to a
denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)
It was discovered that Bind incorrectly accepted NSEC3 records whose signer
name did not match the owning zone. A remote attacker could possibly use
this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC
validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)
It was discovered that Bind incorrectly handled Key Records using the
PRIVATEDNS algorithm. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2026-10822)
It was discovered that Bind incorrectly handled wildcard CNAME expansion in
Response Policy Zones. A remote attacker could possibly use this issue to
bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-11331)
It was discovered that Bind incorrectly tracked memory usage in the DNS
cache. A remote attacker could possibly use this issue to cause Bind to use
memory beyond configured limits, leading to a denial of service. This issue
only affected Ubuntu 20.04 LTS. (CVE-2026-11622)
It was discovered that Bind incorrectly handled signed wildcard records
with label count discrepancies and RRSIG validation. A remote attacker
could possibly use this issue to perform cache poisoning attacks. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 20.04 LTS. (CVE-2026-11721)
It was discovered that Bind incorrectly handled DNSSEC validation when a
domain was covered by both NSEC and NSEC3 records with only one type having
an RRSIG. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13204)
It was discovered that Bind incorrectly validated out-of-zone NSEC next
owner names during DNSSEC validation. A remote attacker could possibly use
this issue to bypass DNSSEC validation. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13321)
It was discovered that Bind incorrectly served zone transfer data before
verifying the TSIG signature on multi-message transfers. A remote attacker
could possibly use this issue to send unauthorized zone contents to a
secondary server. (CVE-2026-19033)
It was discovered that Bind incorrectly handled the lifetime of cached
DNSSEC proofs, leading to a use-after-free. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)
It was discovered that Bind incorrectly handled certain malformed answers
when configured to use DNS64. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service.
(CVE-2026-19666)
It was discovered that Bind incorrectly handled oversized negative answers
when storing them in the negative cache. A remote attacker could possibly
use this issue to cause Bind to crash, resulting in a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667)
It was discovered that Bind incorrectly handled large numbers of certain
invalid DNSSEC records during validation. A remote attacker could possibly
use this issue to cause Bind to use excessive resources, leading to a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-19668)
It was discovered that Bind incorrectly accepted inapplicable NSEC records
as proof that no wildcard existed. A remote attacker could possibly use
this issue to forge NXDOMAIN responses, masking the existence of wildcard
records. (CVE-2026-19941)
It was discovered that Bind incorrectly handled repeated copies of records
that should only appear once, such as SOA, CNAME, or DNAME records. A
remote attacker could possibly use this issue to cause Bind to use
excessive memory, leading to a denial of service. (CVE-2026-75029)
It was discovered that Bind incorrectly handled TKEY queries when the
configuration did not contain a global options block. A remote attacker
could possibly use this issue to cause Bind to crash, resulting in a denial
of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)
It was discovered that Bind incorrectly accepted NSEC3 records from
unrelated sibling zones as proof of an insecure delegation. A remote
attacker could possibly use this issue to bypass DNSSEC validation and
inject forged unsigned answers. (CVE-2026-77119)
It was discovered that Bind incorrectly handled DNS-over-HTTPS requests
containing invalid SIG(0) records when the connection was closed
prematurely. A remote attacker could possibly use this issue to cause Bind
to crash, resulting in a denial of service. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-77692)
It was discovered that Bind incorrectly treated NS or DNAME records
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | bind9 | 1:9.18.39-0ubuntu0.22.04.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | bind9 | 1:9.18.39-0ubuntu0.24.04.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | bind9 | 1:9.20.24-1ubuntu0.4 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.19+esm15 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | bind9 | 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | bind9 | 1:9.11.3+dfsg-1ubuntu1.19+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | bind9 | 1:9.18.30-0ubuntu0.20.04.2+esm3 |
Vulnerabilities 24
-
High 8.6CVE-2025-40778 Public exploit
Cache poisoning attacks with unsolicited RRs
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …
-
High 8.6
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1,…
-
High 7.5CVE-2025-8677 EPSS 11%
Resource exhaustion via malformed DNSKEY handling
Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…
-
High 7.5
Potential wildcard CNAME RPZ policy bypass
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It…
-
High 7.5
Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage c…
-
High 7.5
Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, wh…
-
High 7.5
Unexpected exit in certain situations with NSEC and NSEC3 both present
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…
-
High 7.5
Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make re…
-
High 7.5
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…
-
High 7.5
Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…
-
High 7.5
named aborts on a TKEY query when the user configuration has no global options statement
If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9…
-
High 7.5
Unauthenticated remote crash of named via a single DoH SIG(0) request
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through…
-
High 7.5
Validating resolver can abort while caching a mismatched NOQNAME proof
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…
-
High 7.5
SVCB AliasMode additional-data error leaks qpcache references
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from per…
-
High 7.5
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…
-
Medium 6.8
Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through …
-
Medium 6.5
Key Record using PRIVATEDNS algorithm may lead to unexpected exit
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorith…
-
Medium 6.5
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signatur…
-
Medium 5.9
qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…
-
Medium 5.9
checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 …
-
Medium 5.9
NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…
-
Medium 5.8
Out-of-zone database nodes can become authoritative zone cuts
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose a…
-
Medium 5.3
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affe…
-
Medium 5.3
Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …
References
-
report
https://ubuntu.com/security/CVE-2025-8677
-
report
https://ubuntu.com/security/CVE-2025-40778
-
report
https://ubuntu.com/security/CVE-2026-1519
-
report
https://ubuntu.com/security/CVE-2026-10723
-
report
https://ubuntu.com/security/CVE-2026-10822
-
report
https://ubuntu.com/security/CVE-2026-11331
-
report
https://ubuntu.com/security/CVE-2026-11622
-
report
https://ubuntu.com/security/CVE-2026-11721
-
report
https://ubuntu.com/security/CVE-2026-13204
-
report
https://ubuntu.com/security/CVE-2026-13321
-
report
https://ubuntu.com/security/CVE-2026-19033
-
report
https://ubuntu.com/security/CVE-2026-19662
-
report
https://ubuntu.com/security/CVE-2026-19666
-
report
https://ubuntu.com/security/CVE-2026-19667
-
report
https://ubuntu.com/security/CVE-2026-19668
-
report
https://ubuntu.com/security/CVE-2026-19941
-
report
https://ubuntu.com/security/CVE-2026-75029
-
report
https://ubuntu.com/security/CVE-2026-76163
-
report
https://ubuntu.com/security/CVE-2026-77119
-
report
https://ubuntu.com/security/CVE-2026-77692
-
report
https://ubuntu.com/security/CVE-2026-78301
-
report
https://ubuntu.com/security/CVE-2026-80274
-
report
https://ubuntu.com/security/CVE-2026-81563
-
report
https://ubuntu.com/security/CVE-2026-81736