RLSA-2026:93610: Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/bindto a version that resolves this vulnerability.Fixed in 2:9.16.23-40.el9_8.13
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which BIND components may be affected by this update?
The advisory identifies BIND as including the named DNS server, resolver library, and operational verification tools, but it does not specify which individual components are affected by each listed CVE.
What types of impact are addressed by this update?
The update addresses multiple denial-of-service issues, including unbounded processing of crafted DNS messages and assertion failures in redirect and RPZ query processing. It also addresses arbitrary code execution through GSS-TSIG UDP message replay.
Does exploitation require authentication or user interaction?
The provided severity vector indicates network attack access, no privileges required, and no user interaction required. It also indicates high confidentiality, integrity, and availability impact, while attack complexity is high.