RHSA-2026:93925HighCVSS 8.1

Red Hat Security Advisory: bind security, bug fix, and enhancement update

Published
November 2, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (3)

CVE-2026-19630 →CVE-2026-19662 →CVE-2026-94300 →

📋 Description

CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19662 — bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

🎯 Affected products173

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-32:9.11.36-18.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-32:9.11.36-18.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-chroot-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-chroot-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-chroot-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-chroot-32:9.11.36-18.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debuginfo-32:9.11.36-18.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • bind-debugsource-32:9.11.36-18.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +143 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, consider disabling DNSSEC validation on `named` resolvers if it is not a strict requirement for your environment. This can be achieved by setting `dnssec-validation no;` in the `named.conf` file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the `named` service must be reloaded or restarted for the changes to take effect. `sudo systemctl reload named` `sudo systemctl restart named` Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.

🔗 References (6)