SUSE-SU-2026:5118-1: Security update for bind

Q: Which BIND deployment roles should be prioritized for this update?

Recursive resolvers are directly implicated by the qpcache use-after-free issue, while authoritative DNS services are implicated by the IXFR, zone-cut, and wildcard-proof issues. Deployments performing DNSSEC validation or handling DNSSEC material should also be prioritized because several issues involve NSEC, NSEC3, and DNSSEC cryptographic matching.

Q: What operational impact is indicated by the listed issues?

The advisory identifies a recursive-resolver crash through a use-after-free condition and resource exhaustion through excessive DNSSEC cryptographic material matching and retained singleton RDATA. It also states that unauthenticated IXFR deltas can be applied to a live zone before TSIG verification, indicating risk to zone-update handling.

Q: How can I determine whether installed software is in scope?

The advisory lists bind, libbind9, libdns1605, libisccfg1600, and related debuginfo packages, as well as SUSE Multi-Linux Manager Client Tools for SLE Micro 5. No affected or fixed package versions are provided in the supplied information, so version-level exposure cannot be determined from this advisory text alone.

Published Nov 5, 2026

Updated

This update for bind fixes the following issues:

- CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436). - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437). - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438). - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440). - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).

Other sources

This update for bind fixes the following issues: CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). CVE-2026-19668: Resource exhaustion via excessive DNSSEC cryptographic material matching (bsc#1280436). CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437). CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438). CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440). CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).

— SUSE

Affected Software

22 affected componentsFixes available

suse/bind<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

All of the following

SUSE SUSE Multi-Linux Manager Client Tools for SLE Micro 5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/bind-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisc1606-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisccfg1600<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libdns1605<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libdns1605-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisccc1600<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/bind-debugsource<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/bind-utils<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/bind-utils-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libbind9<1600-9.16.6-150000.12.97.1

1600-9.16.6-150000.12.97.1

suse/libbind9<1600-debuginfo-9.16.6-150000.12.97.1

1600-debuginfo-9.16.6-150000.12.97.1

suse/libirs1601<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisc1606<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libns1604-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisccc1600-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libns1604<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libisccfg1600-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

suse/libirs1601-debuginfo<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

All of the following

SUSE SUSE Multi-Linux Manager Client Tools for SLE Micro 5 (noarch)

suse/python3-bind<9.16.6-150000.12.97.1

9.16.6-150000.12.97.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/bind to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/bind-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisc1606-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisccfg1600 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libdns1605 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libdns1605-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisccc1600 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/bind-debugsource to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/bind-utils to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/bind-utils-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libbind9 to a version that resolves this vulnerability.
Fixed in 1600-9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libbind9 to a version that resolves this vulnerability.
Fixed in 1600-debuginfo-9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libirs1601 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisc1606 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libns1604-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisccc1600-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libns1604 to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libisccfg1600-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/libirs1601-debuginfo to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade suse/python3-bind to a version that resolves this vulnerability.
Fixed in 9.16.6-150000.12.97.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-MultiLinuxManagerTools-SLE-Micro-5-2026-5118

Event History

Nov 5, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Advisory Published

via SUSE·12:00 PM

Data Sourced

via SUSE·12:00 PM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which BIND deployment roles should be prioritized for this update?

Recursive resolvers are directly implicated by the qpcache use-after-free issue, while authoritative DNS services are implicated by the IXFR, zone-cut, and wildcard-proof issues. Deployments performing DNSSEC validation or handling DNSSEC material should also be prioritized because several issues involve NSEC, NSEC3, and DNSSEC cryptographic matching.

What operational impact is indicated by the listed issues?

The advisory identifies a recursive-resolver crash through a use-after-free condition and resource exhaustion through excessive DNSSEC cryptographic material matching and retained singleton RDATA. It also states that unauthenticated IXFR deltas can be applied to a live zone before TSIG verification, indicating risk to zone-update handling.

How can I determine whether installed software is in scope?

The advisory lists bind, libbind9, libdns1605, libisccfg1600, and related debuginfo packages, as well as SUSE Multi-Linux Manager Client Tools for SLE Micro 5. No affected or fixed package versions are provided in the supplied information, so version-level exposure cannot be determined from this advisory text alone.

SUSE-SU-2026:5118-1: Security update for bind

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which BIND deployment roles should be prioritized for this update?

What operational impact is indicated by the listed issues?

How can I determine whether installed software is in scope?

Company

Resources

Contact

Frequently Asked Questions

Which BIND deployment roles should be prioritized for this update?

What operational impact is indicated by the listed issues?

How can I determine whether installed software is in scope?