RLSA-2026:97242: Moderate: bind security, bug fix, and enhancement update

Q: What access or interaction does an attacker need?

The reported CVSS vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction.

Q: What is the reported security impact?

The advisory reports a medium severity score of 5.3. Its CVSS vector indicates no confidentiality or integrity impact and low availability impact.

Q: Which BIND packages are identified in the update scope?

The listed packages are bind-devel, bind-dnssec-utils, bind-dnssec-utils-debuginfo, bind-libs-debuginfo, bind-chroot, bind-debugsource, bind-debuginfo, and bind-utils-debuginfo for Rocky Linux.

Published Nov 13, 2026

Updated

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)

bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)

Bug Fix(es) and Enhancement(s):

[BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 [rhel-10] (JIRA:Rocky Linux-142289)

[rhel-10] Bind 9.18.33 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144421)

bind: New root trust anchor key for DNSSEC [rhel-10.3] (JIRA:Rocky Linux-255748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Affected Software

13 affected componentsFixes available

rocky-linux/bind-devel<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-dnssec-utils-debuginfo<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-libs-debuginfo<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-chroot<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-debugsource<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-debuginfo<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-dnssec-utils<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-utils-debuginfo<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-utils<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-libs<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-doc<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

rocky-linux/bind-license<2:9.18.33-29.el10_3

2:9.18.33-29.el10_3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/bind-devel to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-dnssec-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-chroot to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-debugsource to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-debuginfo to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-dnssec-utils to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-utils to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-libs to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-doc to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3
Upgrade
Upgrade rocky-linux/bind-license to a version that resolves this vulnerability.
Fixed in 2:9.18.33-29.el10_3

Event History

Nov 13, 2026

Advisory Published

via OSV·12:06 PM

Data Sourced

via OSV·12:06 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What access or interaction does an attacker need?

The reported CVSS vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction.

What is the reported security impact?

The advisory reports a medium severity score of 5.3. Its CVSS vector indicates no confidentiality or integrity impact and low availability impact.

Which BIND packages are identified in the update scope?

The listed packages are bind-devel, bind-dnssec-utils, bind-dnssec-utils-debuginfo, bind-libs-debuginfo, bind-chroot, bind-debugsource, bind-debuginfo, and bind-utils-debuginfo for Rocky Linux.

RLSA-2026:97242: Moderate: bind security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access or interaction does an attacker need?

What is the reported security impact?

Which BIND packages are identified in the update scope?

Company

Resources

Contact

Frequently Asked Questions

What access or interaction does an attacker need?

What is the reported security impact?

Which BIND packages are identified in the update scope?