RLSA-2026:94011: Important: bind9.16 security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)
bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/bind9.16to a version that resolves this vulnerability.Fixed in 2:9.16.23-0.22.el8_10.21
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which BIND components may be relevant to this update?
The affected software package provides the named DNS server, a resolver library for applications that interface with DNS, and tools for verifying DNS server operation. The advisory does not identify which individual component is affected by each listed issue.
What attack outcomes are identified in the security fixes?
The listed fixes address multiple denial-of-service conditions, including crafted DNSSEC responses, crafted DNS messages, redirect processing, and RPZ query processing. One issue is described as allowing arbitrary code execution through GSS-TSIG UDP message replay.
Does exploitation require authentication or user interaction?
The provided CVSS vector indicates no privileges are required and no user interaction is required. It also indicates network attack vector and high attack complexity.