RHSA-2026:92419HighCVSS 8.1

Red Hat Security Advisory: bind security update

Published
October 29, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (4)

CVE-2026-19630 →CVE-2026-94300 →CVE-2026-96888 →CVE-2026-97313 →

📋 Description

CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-96888 — bind: bind: Denial of Service via assertion failure during redirect processing CVE-2026-97313 — bind: bind: Denial of service via assertion failure in RPZ query processing

🎯 Affected products69

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-32:9.18.33-15.el10_2.14.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-chroot-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-chroot-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-chroot-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-chroot-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debuginfo-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • bind-debugsource-32:9.18.33-15.el10_2.14.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-devel-32:9.18.33-15.el10_2.14.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-devel-32:9.18.33-15.el10_2.14.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • bind-devel-32:9.18.33-15.el10_2.14.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • +39 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients. Workaround: Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies. Alternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL). After modifying the configuration, validate the syntax and reload the service: ``` named-checkconf systemctl reload named ``` Caveats: Aligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups. Warning: Reloading or restarting the `named` service may cause a momentary pause in active DNS query processing.

🔗 References (7)