RHSA-2026:87309HighCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 21, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (4)

CVE-2026-94300 →CVE-2026-96888 →CVE-2026-97313 →CVE-2026-19630 →

📋 Description

CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-96888 — bind: bind: Denial of Service via assertion failure during redirect processing CVE-2026-97313 — bind: bind: Denial of service via assertion failure in RPZ query processing

🎯 Affected products23

  • Red Hat Hardened Images
  • bind-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-32:9.20.30-0.1.hum1@src as a component of Red Hat Hardened Images
  • bind-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • bind-chroot-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-chroot-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-chroot-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • bind-devel-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-devel-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-devel-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • bind-libs-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-libs-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-libs-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • bind-utils-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • bind-utils-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • bind-utils-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients. Workaround: Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies. Alternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL). After modifying the configuration, validate the syntax and reload the service: ``` named-checkconf systemctl reload named ``` Caveats: Aligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups. Warning: Reloading or restarting the `named` service may cause a momentary pause in active DNS query processing.

🔗 References (8)