RLSA-2026:97585: Moderate: bind9.18 security, bug fix, and enhancement update
BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.
Security Fix(es):
bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Bug Fix(es) and Enhancement(s):
Bind 9.18.29 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144422)
[BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 (JIRA:Rocky Linux-86172)
bind9.18: New root trust anchor key for DNSSEC [rhel-9.9] (JIRA:Rocky Linux-255678)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/bind9.18to a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-chrootto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-debugsourceto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-develto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-dnssec-utilsto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-dnssec-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-libsto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-utilsto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9 - Upgrade
Upgrade
rocky-linux/bind9.18-docto a version that resolves this vulnerability.Fixed in 2:9.18.29-28.el9_9
Event History
Frequently Asked Questions
Which Rocky Linux packages are covered by this update?
The update covers bind9.18, bind9.18-chroot, bind9.18-debuginfo, bind9.18-debugsource, bind9.18-devel, bind9.18-dnssec-utils, bind9.18-dnssec-utils-debuginfo, and bind9.18-libs.
What security issues are addressed?
The update addresses CVE-2026-3592, involving amplification through self-pointed glue records, and CVE-2026-5950, an unbounded resend loop in the BIND 9 resolver. The advisory rates the overall update as medium severity with a CVSS score of 5.3.
Are DNSSEC-related deployments affected by any non-security fixes?
Yes. The update fixes an issue in BIND 9.18.29 where DNSSEC key rollover with KASP could remove a ZSK key prematurely, and it includes a new DNSSEC root trust anchor key.