USN-8929-1: Bind vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778) Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519) It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622) It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721) It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204) It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321) It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033) It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662) It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666) It was discovered that Bind incorrectly handled oversized negative answers when storing them in the negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667) It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668) It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the existence of wildcard records. (CVE-2026-19941) It was discovered that Bind incorrectly handled repeated copies of records that should only appear once, such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. (CVE-2026-75029) It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163) It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and inject forged unsigned answers. (CVE-2026-77119) It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692) It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in cache poisoning. (CVE-2026-78301) It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-80274) It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563) It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)