UBUNTU-CVE-2026-75029: Medium severity ubuntu/bind9 vulnerability

Q: Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Q: What impact is indicated by the severity assessment?

The supplied CVSS vector indicates no confidentiality or integrity impact and a low availability impact. The described effect is increased memory use in the negative cache, with potential for additional memory-related attack vectors.

Published Sep 16, 2026

Updated

In a query response, an attacker may send named multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9<1:9.9.5.dfsg-3ubuntu0.19+esm15

1:9.9.5.dfsg-3ubuntu0.19+esm15

ubuntu/bind9<1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

1:9.10.3.dfsg.P4-8ubuntu1.19+esm11

ubuntu/bind9<1:9.11.3+dfsg-1ubuntu1.19+esm6

1:9.11.3+dfsg-1ubuntu1.19+esm6

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm15
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.11.3+dfsg-1ubuntu1.19+esm6
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

What impact is indicated by the severity assessment?

The supplied CVSS vector indicates no confidentiality or integrity impact and a low availability impact. The described effect is increased memory use in the negative cache, with potential for additional memory-related attack vectors.

UBUNTU-CVE-2026-75029: Medium severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact is indicated by the severity assessment?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact is indicated by the severity assessment?