Red Hat Security AdvisoryRHSA-2026:79113
bind9.16 security, bug fix, and enhancement update
Released 2026-10-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) bind9.16-32:9.16.23-0.22.el8_10.16, bind9.16-chroot-32:9.16.23-0.22.el8_10.16, bind9.16-dnssec-utils-32:9.16.23-0.22.el8_10.16 +4
- Red Hat Enterprise Linux CRB (v. 8) bind9.16-devel-32:9.16.23-0.22.el8_10.16, bind9.16-doc-32:9.16.23-0.22.el8_10.16, bind9.16-libs-32:9.16.23-0.22.el8_10.16
Fixes 3 records
Priority MEDIUM 40
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it w…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-617
Priority MEDIUM 40
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-197
Priority MEDIUM 40
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00569 · Published 2026-09-16 · Partial fix CWE-416
