Description
On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND9 | Open Source Branch 9.18 9.18.0 through versions before 9.18.3, Development Branch 9.19 9.19.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.18.3-1 | — |
| Debian 13 | bind9 | 1:9.18.3-1 | — |
| Debian 12 | bind9 | 1:9.18.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | bind9 | 1:9.18.1-1ubuntu1.1 | USN-5429-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.18.3-1.1 | openSUSE-SU-2024:12129-1 |
Advisories 2
- USN-5429-1 bind9 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:12129-1 bind-9.18.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026