RLSA-2026:97586: Moderate: bind security, bug fix, and enhancement update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Bug Fix(es) and Enhancement(s):
Bind 9.16.23 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-12487)
nslookup does not return and hang at epollwait() on some special occasions. (JIRA:Rocky Linux-29712)
Update to latest minor version 9.16.50 [rhel-9.9] (JIRA:Rocky Linux-6454)
pkcs11-tools test failing on engine (JIRA:Rocky Linux-213788)
dig on s390x does not return output when fails (JIRA:Rocky Linux-212648)
bind: New root trust anchor key for DNSSEC [rhel-9.9] (JIRA:Rocky Linux-255745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/bindto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-chrootto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-debugsourceto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-develto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-dnssec-utilsto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-dnssec-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-libsto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-libs-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-utilsto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-utils-debuginfoto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-dnssec-docto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-docto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/bind-licenseto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade
rocky-linux/python3-bindto a version that resolves this vulnerability.Fixed in 2:9.16.50-11.el9_9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.16.50
Event History
Frequently Asked Questions
Which BIND components are covered by this update?
The update covers BIND packages including the named DNS server, resolver-related libraries, DNSSEC utilities, development files, chroot support, and associated debug packages.
What security impacts are identified for the listed CVEs?
The advisory identifies amplification vulnerabilities involving self-pointed glue records and an unbounded resend loop in the BIND 9 resolver. The provided CVSS vector indicates network-reachable exploitation with no privileges or user interaction required, and availability impact only.
Are there operational fixes included in addition to the security fixes?
Yes. The update includes fixes for premature DNSSEC ZSK removal during KASP key rollover, nslookup hanging in epoll_wait(), and missing dig output on s390x failures. It also includes a new DNSSEC root trust anchor key and an update to BIND 9.16.50 for RHEL 9.9.