Red Hat Security Advisory

RHSA-2026:6935

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-04-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images bind-9.18.48-1.hum1@aarch64, bind-9.18.48-1.hum1@src, bind-9.18.48-1.hum1@x86_64 +12

Fixes 8 records

TI-2025-27240 CVE-2025-40778 · GHSA-xmqp-6cj2-2hh3

Cache poisoning attacks with unsolicited RRs

HIGH 76

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00667 Published 2025-10-22 Fixed CWE-349

TI-2025-07941 CVE-2025-8677 · GHSA-924g-f9mr-cm6x

Resource exhaustion via malformed DNSKEY handling

MEDIUM 52

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10737 Published 2025-10-22 Fixed CWE-405

TI-2025-12682 CVE-2025-13878 · GHSA-p5qx-fwf5-q388

Malformed BRID/HHIT records can cause named to terminate unexpectedly

MEDIUM 51

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09423 Published 2026-01-21 Partial fix CWE-617

TI-2025-27242 CVE-2025-40780 · GHSA-j3w4-m6qj-vmm5

Cache poisoning due to weak PRNG

MEDIUM 44

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00466 Published 2025-10-22 Fixed CWE-341

TI-2026-01209 CVE-2026-1519 · GHSA-84m6-p53c-x4wp

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

MEDIUM 42

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01687 Published 2026-03-25 Fixed CWE-606

TI-2026-02681 CVE-2026-3104 · GHSA-vwv5-298p-pw28

Memory leak in code preparing DNSSEC proofs of non-existence

MEDIUM 40

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00711 Published 2026-03-25 Fixed in 9.18.0, 9.18.11-S1 CWE-772

TI-2026-02696 CVE-2026-3119 · GHSA-rrrp-782c-4484

Authenticated query containing a TKEY record may cause named to terminate unexpectedly

LOW 30

Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00586 Published 2026-03-25 Partial fix · 9.18.0, 9.18.11-S1 CWE-617

TI-2026-03096 CVE-2026-3591 · GHSA-5fv2-2p94-9gh7

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

LOW 25

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00367 Published 2026-03-25 Partial fix · 9.18.0, 9.18.11-S1 CWE-305