Summary
It was discovered that Bind incorrectly handled certain DNS messages
with repeated singleton records such as SOA, CNAME, or DNAME records.
A remote attacker could possibly use this issue to cause Bind to use
excessive memory, leading to a denial of service. This issue only affected
Ubuntu 26.10. (CVE-2026-75029)
It was discovered that Bind incorrectly handled cached DNSSEC proofs.
A remote attacker could possibly use this issue to cause Bind to crash,
resulting in a denial of service. This issue only affected
Ubuntu 26.10. (CVE-2026-19662)
It was discovered that Bind incorrectly handled certain invalid DNSSEC
records. A remote attacker could possibly use this issue to cause Bind
to use excessive CPU resources, leading to a denial of service. This issue only affected
Ubuntu 26.10.
(CVE-2026-19668)
It was discovered that Bind incorrectly handled malformed answers on
resolvers configured to use DNS64. A remote attacker could possibly use
this issue to cause Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 26.10.
(CVE-2026-19666)
It was discovered that Bind incorrectly handled TKEY queries when no
global options block was present. A remote attacker could possibly use
this issue to cause Bind to crash, resulting in a denial of service.
This issue only affected
Ubuntu 26.10.
(CVE-2026-76163)
It was discovered that Bind incorrectly verified TSIG signatures during
zone transfers. A remote attacker could possibly use this issue to inject
unauthorized zone contents into a secondary server. This issue only affected
Ubuntu 26.10. (CVE-2026-19033)
It was discovered that Bind incorrectly handled certain NSEC wildcard
proofs. A remote attacker could possibly use this issue to forge NXDOMAIN
responses and hide the existence of wildcard records. This issue only affected
Ubuntu 26.10. (CVE-2026-19941)
It was discovered that Bind incorrectly handled DNS-over-HTTPS requests
with invalid SIG(0) records. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 26.10. (CVE-2026-77692)
It was discovered that Bind incorrectly handled malformed zones
containing NS or DNAME nodes above the zone origin. An attacker could
possibly use this issue to cause Bind to serve out-of-zone records as
authoritative, leading to cache poisoning. This issue only affected
Ubuntu 26.10. (CVE-2026-78301)
It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode
records referencing large numbers of ServiceMode records. A remote
attacker could possibly use this issue to cause Bind to exhaust
resources, leading to a denial of service. This issue only affected
Ubuntu 26.10. (CVE-2026-81563)
It was discovered that Bind incorrectly validated NSEC3 records from
unrelated sibling zones. A remote attacker could possibly use this issue
to perform a DNSSEC downgrade attack and have forged unsigned answers
accepted. This issue only affected
Ubuntu 26.10. (CVE-2026-77119)
It was discovered that Bind incorrectly handled wildcard answers with
mixed NSEC and NSEC3 proofs. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 26.10.
(CVE-2026-80274)
It was discovered that Bind incorrectly handled oversized negative
cache records. A remote attacker could possibly use this issue to cause
Bind to crash, resulting in a denial of service. This issue only affected
Ubuntu 26.10. (CVE-2026-19667)
It was discovered that Bind incorrectly handled cached trees of
SVCB/HTTPS AliasMode records. A remote attacker could possibly use this
issue to cause Bind to use excessive CPU resources, leading to a denial
of service. This issue only affected
Ubuntu 26.10. (CVE-2026-81736)
It was discovered that Bind incorrectly limited the processing of
compression pointers in inbound DNS messages. A remote attacker could
possibly use this issue to cause Bind to use excessive CPU and memory
resources, leading to a denial of service. (CVE-2026-19630)
It was discovered that Bind incorrectly serialized access to shared
GSS-TSIG security contexts. A remote attacker could possibly use this
issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)
It was discovered that Bind incorrectly handled redirect zones when
used together with strict QNAME minimization. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial
of service. (CVE-2026-96888)
It was discovered that Bind incorrectly handled certain RPZ
configurations when processing queries with and without recursion. A
remote attacker could possibly use this issue to cause Bind to crash,
resulting in a denial of service. (CVE-2026-97313)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | bind9 | 1:9.18.39-0ubuntu0.22.04.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | bind9 | 1:9.18.39-0ubuntu0.24.04.9 |
| Ubuntu · 26.04 LTS 26.04:LTS | bind9 | 1:9.20.24-1ubuntu0.5 |
| Ubuntu · 26.10 | bind9 | 1:9.20.24-1ubuntu3.1 |
Vulnerabilities 18
-
High 8.1CVE-2026-94300 Public exploit
Concurrent GSS-TSIG messages corrupt memory
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…
-
High 7.5
Amplified resource exhaustion in inbound message processing
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amo…
-
High 7.5
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.2…
-
High 7.5
Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 vers…
-
High 7.5
named aborts on a TKEY query when the user configuration has no global options statement
If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9…
-
High 7.5
Unauthenticated remote crash of named via a single DoH SIG(0) request
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through…
-
High 7.5
Validating resolver can abort while caching a mismatched NOQNAME proof
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.…
-
High 7.5
SVCB AliasMode additional-data error leaks qpcache references
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from per…
-
High 7.5
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…
-
High 7.5
Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through…
-
High 7.5
Specific RPZ configurations and query patterns may result in an unexpected exit
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …
-
Medium 6.5
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signatur…
-
Medium 5.9
qpcache NOQNAME proof use-after-free crashes recursive resolver
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a p…
-
Medium 5.9
checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 …
-
Medium 5.9
NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…
-
Medium 5.8
Out-of-zone database nodes can become authoritative zone cuts
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose a…
-
Medium 5.3
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affe…
-
Medium 5.3
Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …
References
-
report
https://ubuntu.com/security/CVE-2026-19033
-
report
https://ubuntu.com/security/CVE-2026-19630
-
report
https://ubuntu.com/security/CVE-2026-19662
-
report
https://ubuntu.com/security/CVE-2026-19666
-
report
https://ubuntu.com/security/CVE-2026-19667
-
report
https://ubuntu.com/security/CVE-2026-19668
-
report
https://ubuntu.com/security/CVE-2026-19941
-
report
https://ubuntu.com/security/CVE-2026-75029
-
report
https://ubuntu.com/security/CVE-2026-76163
-
report
https://ubuntu.com/security/CVE-2026-77119
-
report
https://ubuntu.com/security/CVE-2026-77692
-
report
https://ubuntu.com/security/CVE-2026-78301
-
report
https://ubuntu.com/security/CVE-2026-80274
-
report
https://ubuntu.com/security/CVE-2026-81563
-
report
https://ubuntu.com/security/CVE-2026-81736
-
report
https://ubuntu.com/security/CVE-2026-94300
-
report
https://ubuntu.com/security/CVE-2026-96888
-
report
https://ubuntu.com/security/CVE-2026-97313