Read the docs
TI-2026-09290 Aliases CVE-2026-10822GHSA-42qr-f5rc-vfw9

Key Record using PRIVATEDNS algorithm may lead to unexpected exit

Priority LOW 29CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00422 36th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ISCBIND 99.18.0 – 9.18.50; 9.20.0 – 9.20.24; 9.21.0 – 9.21.23; 9.18.11-S1 – 9.18.50-S1; 9.20.9-S1 – 9.20.24-S1—No fix listedCNA
  • BIND 9 VendorISC Affected 9.18.0 – 9.18.50; 9.20.0 – 9.20.24; 9.21.0 – 9.21.23; 9.18.11-S1 – 9.18.50-S1; 9.20.9-S1 – 9.20.24-S1 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*9.18.0 – 9.18.50VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*9.18.11 – 9.18.50VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*9.20.0 – 9.20.24VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*9.20.9 – 9.20.24VulnerableISC
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*9.21.0 – 9.21.23VulnerableISC
  • cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* Versions 9.18.0 – 9.18.50 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:* Versions 9.18.11 – 9.18.50 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* Versions 9.20.0 – 9.20.24 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:* Versions 9.20.9 – 9.20.24 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* Versions 9.21.0 – 9.21.23 Vulnerable ·ISC

Remediation

Red Hat 1 advisory

  • RHSA-2026:54071 Released 2026-08-12 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images bind-32:9.20.26-0.1.hum1@aarch64, bind-32:9.20.26-0.1.hum1@src, bind-32:9.20.26-0.1.hum1@x86_64 +12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:54071

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10822
  2. 2026-10-03 Alias added: GHSA-42qr-f5rc-vfw9
  3. 2026-11-05 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences