RHSA-2026:95242
Vulnerability from csaf_redhat - Published: 2026-11-04 16:04 - Updated: 2026-11-06 05:36Summary
Red Hat Security Advisory: bind security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for bind is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
* bind: bind: Denial of Service via long query names in RPZ processing (CVE-2026-11331)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
* bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
* bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
* bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
* bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)
* bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
* bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)
* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)
Bug Fix(es) and Enhancement(s):
* bind: Avoid costly reload of IdM named due to logrotate operation (JIRA:RHEL-245352)
* bind: New root trust anchor key for DNSSEC (JIRA:RHEL-255760)
* bind 9.16 crash with SIGSEGV (JIRA:RHEL-280606)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
35 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — |
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the bind component, specifically within the `named` daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System (DNS) messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the `named` daemon when processed. Successful exploitation leads to an application level Denial of Service (DoS), making the DNS service unavailable.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
6.8 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Moderate
A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones (RPZ) and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Denial of Service (DoS), or allow the attacker to bypass RPZ security filtering rules.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64 | — |
Vendor Fix
fix
|
Known not affected
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 | — | ||
| Unresolved product id: AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch | — |
Threats
Impact
Important
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.
8.6 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in `bind9`'s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.
8.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-3039
Known not affected
35 products, the same list as for
CVE-2026-3039
Threats
Impact
Important
References
87 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for bind is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)\n\n* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)\n\n* bind: bind: Denial of Service via long query names in RPZ processing (CVE-2026-11331)\n\n* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)\n\n* bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)\n\n* bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)\n\n* bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)\n\n* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)\n\n* bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)\n\n* bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)\n\n* bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\nBug Fix(es) and Enhancement(s):\n\n* bind: Avoid costly reload of IdM named due to logrotate operation (JIRA:RHEL-245352)\n\n* bind: New root trust anchor key for DNSSEC (JIRA:RHEL-255760)\n\n* bind 9.16 crash with SIGSEGV (JIRA:RHEL-280606)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95242",
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2479767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
},
{
"category": "external",
"summary": "2479771",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
},
{
"category": "external",
"summary": "2503721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
},
{
"category": "external",
"summary": "2504166",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
},
{
"category": "external",
"summary": "2504298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504298"
},
{
"category": "external",
"summary": "2504338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
},
{
"category": "external",
"summary": "2504447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
},
{
"category": "external",
"summary": "2504560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
},
{
"category": "external",
"summary": "2535435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535435"
},
{
"category": "external",
"summary": "2535466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535466"
},
{
"category": "external",
"summary": "2535477",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535477"
},
{
"category": "external",
"summary": "2556406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556406"
},
{
"category": "external",
"summary": "2556407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"
},
{
"category": "external",
"summary": "2556413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556413"
},
{
"category": "external",
"summary": "2556415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556415"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95242.json"
}
],
"title": "Red Hat Security Advisory: bind security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-11-06T05:36:52+00:00",
"generator": {
"date": "2026-11-06T05:36:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:95242",
"initial_release_date": "2026-11-04T16:04:40+00:00",
"revision_history": [
{
"date": "2026-11-04T16:04:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-04T16:04:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T05:36:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.16.23-11.el9_2.12.src",
"product": {
"name": "bind-32:9.16.23-11.el9_2.12.src",
"product_id": "bind-32:9.16.23-11.el9_2.12.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.16.23-11.el9_2.12?arch=src\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debugsource@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debuginfo@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils-debuginfo@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs-debuginfo@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_id": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils-debuginfo@9.16.23-11.el9_2.12?arch=aarch64\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debugsource@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debuginfo@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils-debuginfo@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs-debuginfo@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_id": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils-debuginfo@9.16.23-11.el9_2.12?arch=ppc64le\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-libs-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-utils-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debugsource@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debuginfo@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils-debuginfo@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs-debuginfo@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_id": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils-debuginfo@9.16.23-11.el9_2.12?arch=s390x\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debugsource@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-debuginfo@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils-debuginfo@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs-debuginfo@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_id": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils-debuginfo@9.16.23-11.el9_2.12?arch=x86_64\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"product": {
"name": "bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"product_id": "bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-doc@9.16.23-11.el9_2.12?arch=noarch\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "bind-license-32:9.16.23-11.el9_2.12.noarch",
"product": {
"name": "bind-license-32:9.16.23-11.el9_2.12.noarch",
"product_id": "bind-license-32:9.16.23-11.el9_2.12.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-license@9.16.23-11.el9_2.12?arch=noarch\u0026epoch=32"
}
}
},
{
"category": "product_version",
"name": "python3-bind-32:9.16.23-11.el9_2.12.noarch",
"product": {
"name": "python3-bind-32:9.16.23-11.el9_2.12.noarch",
"product_id": "python3-bind-32:9.16.23-11.el9_2.12.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-bind@9.16.23-11.el9_2.12?arch=noarch\u0026epoch=32"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.16.23-11.el9_2.12.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src"
},
"product_reference": "bind-32:9.16.23-11.el9_2.12.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-debugsource-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch"
},
"product_reference": "bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-libs-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-license-32:9.16.23-11.el9_2.12.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch"
},
"product_reference": "bind-license-32:9.16.23-11.el9_2.12.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-utils-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64"
},
"product_reference": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le"
},
"product_reference": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x"
},
"product_reference": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64"
},
"product_reference": "bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-bind-32:9.16.23-11.el9_2.12.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
},
"product_reference": "python3-bind-32:9.16.23-11.el9_2.12.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-3039",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-19T09:48:19.212000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2479767"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API (Generic Security Service Application Program Interface) tokens. This can lead to excessive memory consumption, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: BIND servers configured for TKEY-based GSS-API authentication are vulnerable to memory exhaustion when processing maliciously-constructed packets. This can lead to a denial of service, specifically impacting Red Hat deployments integrated with Active Directory or Kerberos for DNS where this authentication method is enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3039"
},
{
"category": "external",
"summary": "RHBZ#2479767",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479767"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3039"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3039"
}
],
"release_date": "2026-05-21T12:24:11.051000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nExample:\n```bash\n# Edit /etc/named.conf and remove or comment out lines related to tkey-gssapi-keytab or tkey-gssapi-credential.\n# For example, remove or comment out:\n# key \"gssapi-key\" {\n# algorithm GSSAPI;\n# secret \"BASE64_ENCODED_KEY\";\n# };\n#\n# Then reload the named service:\nsystemctl reload named\n```\nReloading the `named` service may cause a brief interruption in DNS resolution.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation"
},
{
"cve": "CVE-2026-5946",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-05-19T09:57:49.705000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2479771"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the bind component, specifically within the `named` daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System (DNS) messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the `named` daemon when processed. Successful exploitation leads to an application level Denial of Service (DoS), making the DNS service unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via specially crafted DNS messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important denial of service vulnerability. The `named` daemon is susceptible to crashes when processing specially crafted DNS messages that utilize non-Internet (IN) classes or meta-classes. This can lead to service unavailability if an attacker sends malicious requests targeting recursion, dynamic updates, zone change notifications, or specific record type processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5946"
},
{
"category": "external",
"summary": "RHBZ#2479771",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479771"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5946"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5946"
}
],
"release_date": "2026-05-21T12:32:55.602000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via specially crafted DNS messages"
},
{
"cve": "CVE-2026-10723",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-07-21T21:13:55.893000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504560"
}
],
"notes": [
{
"category": "description",
"text": "BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Incorrect acceptance of NSEC3 records",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in BIND allows an attacker to forge authenticated NXDOMAIN responses for sibling zones due to incorrect validation of child-zone NSEC3 records. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10723"
},
{
"category": "external",
"summary": "RHBZ#2504560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10723",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10723"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bind: bind9: Incorrect acceptance of NSEC3 records"
},
{
"cve": "CVE-2026-11331",
"cwe": {
"id": "CWE-394",
"name": "Unexpected Status Code or Return Value"
},
"discovery_date": "2026-07-21T16:15:37.317000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503721"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones (RPZ) and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Denial of Service (DoS), or allow the attacker to bypass RPZ security filtering rules.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of Service via long query names in RPZ processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote client can terminate the DNS resolver service or bypass security filtering policies. In default Red Hat Enterprise Linux installations, Response Policy Zones (RPZ) are not configured and require explicit administrative definition. The flaw poses operational risk primarily to recursive resolvers that actively employ wildcard CNAME rules in their policy zones and accept untrusted network queries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11331"
},
{
"category": "external",
"summary": "RHBZ#2503721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503721"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11331"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11331"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict resolver access to trusted networks and avoid using wildcard CNAME entries within Response Policy Zones (RPZ).\n\n1. Edit `/etc/named.conf` to limit recursion and query caching to authorized client networks:\n```\nacl trusted_clients {\n 127.0.0.1;\n 192.168.1.0/24;\n};\n\noptions {\n allow-recursion { trusted_clients; };\n allow-query-cache { trusted_clients; };\n};\n```\nAdditionally, modify RPZ zone files to remove wildcard CNAME statements (such as `*.example.com CNAME target.com`), replacing them with explicit individual domain entries where feasible.\n\n2. Reload the named service configuration:\n`systemctl reload named`\n\nCaveats:\nRestricting query access prevents untrusted external clients from resolving names through the server. Removing wildcard entries means unlisted subdomains will no longer be intercepted by the policy zone until explicit records are added.\n\nWarning: Reloading or restarting the named daemon may briefly disrupt ongoing DNS resolution.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of Service via long query names in RPZ processing"
},
{
"cve": "CVE-2026-11622",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-07-21T20:12:07.757000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504298"
}
],
"notes": [
{
"category": "description",
"text": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Potential memory usage beyond configured limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in BIND\u0027s DNSSEC-validating resolver can lead to a denial of service. An attacker can trigger excessive memory usage by performing a random subdomain attack against a DNSSEC-signed zone, causing the resolver to exceed its `max-cache-size` limits. This is critical for Red Hat deployments where BIND is configured for DNSSEC validation and exposed to untrusted query sources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11622"
},
{
"category": "external",
"summary": "RHBZ#2504298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11622"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11622",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11622"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: Potential memory usage beyond configured limits"
},
{
"cve": "CVE-2026-11721",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-07-21T20:22:21.905000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504338"
}
],
"notes": [
{
"category": "description",
"text": "It is possible for an attacker\u0027s zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker\u0027s zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as Important because a remote, unauthenticated attacker can poison the DNS resolver cache without prior privileges or user interaction, potentially spoofing records across the network. In Red Hat Enterprise Linux environments utilizing BIND as a recursive resolver, this condition is present under default settings. Authoritative-only configurations or isolated instances not performing recursive lookups for untrusted clients remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11721"
},
{
"category": "external",
"summary": "RHBZ#2504338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11721"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11721"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards"
},
{
"cve": "CVE-2026-13204",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-07-21T20:41:55.541000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504447"
}
],
"notes": [
{
"category": "description",
"text": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger an abrupt service crash in BIND, resulting in a total denial of service for DNS resolution. In standard Red Hat Enterprise Linux deployments, recursive DNS servers have DNSSEC validation active by default, making them susceptible whenever resolving domains that present contradictory proof records. Systems operating solely as authoritative nameservers without recursion or DNSSEC validation are unaffected by this defect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13204"
},
{
"category": "external",
"summary": "RHBZ#2504447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13204"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13204"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: Unexpected exit with NSEC and NSEC3 both present"
},
{
"cve": "CVE-2026-13321",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-07-21T19:40:30.464000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504166"
}
],
"notes": [
{
"category": "description",
"text": "The BIND resolver accepts validly-signed NSEC records where the \"Next Domain Name\" field points outside the signer\u0027s zone.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An attacker controlling any DNSSEC-signed zone can craft NSEC records that span into victim zones, enabling cross-zone cache poisoning with authenticated denial-of-service responses (AD=1).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13321"
},
{
"category": "external",
"summary": "RHBZ#2504166",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504166"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13321"
}
],
"release_date": "2026-07-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "Disclaimer: The following mitigation notes are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nISC states no workarounds exist. Until patched, restrict the resolver to authorized client networks and deploy separate resolvers per trust zone. Memory hardening and auth controls don\u0027t apply \u2014 this is a DNS protocol logic error using validly-signed records.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field"
},
{
"cve": "CVE-2026-19630",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-20T19:42:24.891000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556406"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU and memory resources without requiring privileges, resulting in a denial of service. In Red Hat Enterprise Linux and OpenShift environments, the risk primarily affects BIND instances functioning as recursive resolvers exposed to untrusted traffic. Deployments serving strictly authoritative roles or those isolated from untrusted client queries experience significantly lower exposure to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19630"
},
{
"category": "external",
"summary": "RHBZ#2556406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556406"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19630"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19630",
"url": "https://kb.isc.org/docs/cve-2026-19630"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages"
},
{
"cve": "CVE-2026-19666",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-09-16T14:34:53.189451+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535477"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via malformed DNS64 responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This denial of service vulnerability affects BIND resolvers configured to use the `dns64` feature. A specially crafted malformed DNS64 response from an authoritative server can cause the `named` process to unexpectedly terminate, leading to service unavailability. Exploitation requires the `dns64` feature to be explicitly enabled in the resolver\u0027s configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19666"
},
{
"category": "external",
"summary": "RHBZ#2535477",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535477"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19666"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19666",
"url": "https://kb.isc.org/docs/cve-2026-19666"
}
],
"release_date": "2026-09-16T14:02:30.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via malformed DNS64 responses"
},
{
"cve": "CVE-2026-19667",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535435"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in `bind9`\u0027s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in BIND 9\u0027s `named` service. An attacker-controlled authoritative server can trigger a `named` abort by sending a precisely sized negative DNS answer. This vulnerability primarily affects BIND instances configured as recursive resolvers that query untrusted authoritative servers, leading to service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19667"
},
{
"category": "external",
"summary": "RHBZ#2535435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535435"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19667",
"url": "https://kb.isc.org/docs/cve-2026-19667"
}
],
"release_date": "2026-09-16T13:46:56.783000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers.\n\nExample configuration in `named.conf`:\n```\noptions {\n forwarders { 192.0.2.1; 192.0.2.2; };\n forward only;\n};\n```\nReplace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling"
},
{
"cve": "CVE-2026-80274",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-09-16T14:31:05.646441+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via crafted DNSSEC reply",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in BIND resolvers. When DNSSEC validation is enabled, a specially crafted DNSSEC reply from an authoritative server can cause the BIND resolver to unexpectedly exit, leading to a disruption of DNS resolution services. This impacts the availability of DNS resolution on affected Red Hat systems configured with DNSSEC.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80274"
},
{
"category": "external",
"summary": "RHBZ#2535466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-80274",
"url": "https://kb.isc.org/docs/cve-2026-80274"
}
],
"release_date": "2026-09-16T14:07:20.058000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via crafted DNSSEC reply"
},
{
"cve": "CVE-2026-94300",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"discovery_date": "2026-10-20T19:46:35.830000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as Important rather than Critical because, while remote unauthenticated code execution is possible, exploitation depends on capturing active cryptographic keys within their validity window and orchestrating complex concurrent requests. In standard Red Hat Enterprise Linux deployments, the BIND daemon does not enable GSS-TSIG by default, restricting risk primarily to servers integrated with Kerberos-based identity infrastructure like FreeIPA or Active Directory. Deployments that do not negotiate GSS-TSIG keys or that strictly limit dynamic DNS access to trusted networks remain unexposed to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94300"
},
{
"category": "external",
"summary": "RHBZ#2556407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94300"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-94300",
"url": "https://kb.isc.org/docs/cve-2026-94300"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls.\n\nTo disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service:\n\nsystemctl restart named\n\nIf operating named inside a chroot environment, execute:\n\nsystemctl restart named-chroot\n\nAlternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access.\n\nCaveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment.\nWarning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay"
},
{
"cve": "CVE-2026-96888",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-19T18:50:52.794000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556413"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of Service via assertion failure during redirect processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger a denial of service by causing the named daemon to crash without prior privileges. Exploitation is restricted to recursive resolvers where administrators have explicitly configured redirect zones alongside strict query name minimization. Standard Red Hat Enterprise Linux installations do not employ these non-default settings out of the box, significantly limiting exposure on typical systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96888"
},
{
"category": "external",
"summary": "RHBZ#2556413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556413"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96888"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-96888",
"url": "https://kb.isc.org/docs/cve-2026-96888"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of Service via assertion failure during redirect processing"
},
{
"cve": "CVE-2026-97313",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-20T19:57:36.315000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556415"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of service via assertion failure in RPZ query processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can crash the BIND name service, causing a denial of service for all dependent infrastructure. Exploitation requires a specific, non-default deployment where recursive queries are permitted alongside multiple response policy zones configured with conflicting recursive-only options. Default Red Hat Enterprise Linux configurations do not define response policy zones and are therefore not exposed unless administrators have explicitly implemented this combination of policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"known_not_affected": [
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97313"
},
{
"category": "external",
"summary": "RHBZ#2556415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556415"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-97313",
"url": "https://kb.isc.org/docs/cve-2026-97313"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-04T16:04:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95242"
},
{
"category": "workaround",
"details": "Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies.\n\nAlternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL).\n\nAfter modifying the configuration, validate the syntax and reload the service:\n\n```\nnamed-checkconf\nsystemctl reload named\n```\n\nCaveats:\nAligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups.\n\nWarning:\nReloading or restarting the `named` service may cause a momentary pause in active DNS query processing.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.src",
"AppStream-9.2.0.Z.E4S:bind-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-chroot-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-debugsource-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-doc-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-dnssec-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-libs-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-license-32:9.16.23-11.el9_2.12.noarch",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.aarch64",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.ppc64le",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.s390x",
"AppStream-9.2.0.Z.E4S:bind-utils-debuginfo-32:9.16.23-11.el9_2.12.x86_64",
"AppStream-9.2.0.Z.E4S:python3-bind-32:9.16.23-11.el9_2.12.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of service via assertion failure in RPZ query processing"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.