Red Hat Security AdvisoryRHSA-2026:75767
bind security update
Released 2026-10-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) bind-32:9.16.23-40.el9_8.10, bind-chroot-32:9.16.23-40.el9_8.10, bind-dnssec-doc-32:9.16.23-40.el9_8.10 +5
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) bind-devel-32:9.16.23-40.el9_8.10, bind-doc-32:9.16.23-40.el9_8.10, bind-libs-32:9.16.23-40.el9_8.10
Fixes 3 records
Priority MEDIUM 40
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it w…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-617
Priority MEDIUM 40
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-197
Priority MEDIUM 40
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-416
