Red Hat Security Advisory

RHSA-2026:87309

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images bind-32:9.20.30-0.1.hum1@aarch64, bind-32:9.20.30-0.1.hum1@s390x, bind-32:9.20.30-0.1.hum1@src +19

Fixes 4 records

TI-2026-78787 CVE-2026-97313 · GHSA-9p2q-wv22-f9q8

Reachable assertion in BIND 9 RPZ handling causes server exit

LOW 39

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00448 Published 2026-10-21 Partial fix CWE-617

TI-2026-78764 CVE-2026-96888 · GHSA-4x52-cj5p-p824

BIND named crashes with redirect zone and strict QNAME minimization

LOW 39

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-10-21 Partial fix CWE-476

TI-2026-78763 CVE-2026-94300 · GHSA-3g58-6x5w-h3fm

Replayed GSS-TSIG messages corrupt memory in ISC BIND 9

LOW 39

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00953 Published 2026-10-21 Partial fix CWE-362

TI-2026-78762 CVE-2026-19630 · GHSA-53h2-668w-c49r

Resource exhaustion in BIND 9 via crafted inbound DNS messages

LOW 39

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00448 Published 2026-10-21 Partial fix CWE-407