ALSA-2026:93925: Important: bind security, bug fix, and enhancement update

Published Nov 2, 2026
·
Updated

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)

Bug Fix(es) and Enhancement(s):

random named crashes on different AlmaLinux 8.10 resolvers after of installing bind-9.11.36-16.el810.14 (RHSA-2026:54654) (JIRA:RHEL-257162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

17 affected componentsFixes available
almalinux/bind<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-chroot<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-devel<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-export-devel<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-export-libs<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-libs<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-libs-lite<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-license<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-lite-devel<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-pkcs11<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-pkcs11-devel<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-pkcs11-libs<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-pkcs11-utils<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-sdb<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-sdb-chroot<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/bind-utils<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10
almalinux/python3-bind<32:9.11.36-18.el8_10
32:9.11.36-18.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade almalinux/bind to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  2. Upgrade

    Upgrade almalinux/bind-chroot to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  3. Upgrade

    Upgrade almalinux/bind-devel to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  4. Upgrade

    Upgrade almalinux/bind-export-devel to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  5. Upgrade

    Upgrade almalinux/bind-export-libs to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  6. Upgrade

    Upgrade almalinux/bind-libs to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  7. Upgrade

    Upgrade almalinux/bind-libs-lite to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  8. Upgrade

    Upgrade almalinux/bind-license to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  9. Upgrade

    Upgrade almalinux/bind-lite-devel to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  10. Upgrade

    Upgrade almalinux/bind-pkcs11 to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  11. Upgrade

    Upgrade almalinux/bind-pkcs11-devel to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  12. Upgrade

    Upgrade almalinux/bind-pkcs11-libs to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  13. Upgrade

    Upgrade almalinux/bind-pkcs11-utils to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  14. Upgrade

    Upgrade almalinux/bind-sdb to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  15. Upgrade

    Upgrade almalinux/bind-sdb-chroot to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  16. Upgrade

    Upgrade almalinux/bind-utils to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  17. Upgrade

    Upgrade almalinux/python3-bind to a version that resolves this vulnerability.

    Fixed in 32:9.11.36-18.el8_10
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch RHSA-2026:54654

Event History

Nov 2, 2026
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which BIND deployments should be prioritized for remediation?

Prioritize systems running the BIND DNS server (named), particularly deployments that process DNSSEC responses, accept DNS messages from untrusted sources, or use GSS-TSIG over UDP. The advisory also lists BIND resolver libraries and related packages, but the described security impacts target BIND DNS processing and GSS-TSIG handling.

2

What attacker interaction is required for the listed vulnerabilities?

The denial-of-service issues require crafted DNSSEC responses or crafted DNS messages to be processed by BIND. The arbitrary code execution issue involves replay of GSS-TSIG UDP messages.

3

Are there non-security reasons to apply this update?

Yes. The update also addresses reports of random named crashes on AlmaLinux 8.10 resolvers after installation of bind-9.11.36-16.el8_10.14.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203