RHSA-2026:94011HighCVSS 8.1

Red Hat Security Advisory: bind9.16 security update

Published
November 2, 2026
Last Modified
November 7, 2026

🔗 CVE IDs covered (5)

CVE-2026-96888 →CVE-2026-97313 →CVE-2026-19630 →CVE-2026-19662 →CVE-2026-94300 →

📋 Description

CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19662 — bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-96888 — bind: bind: Denial of Service via assertion failure during redirect processing CVE-2026-97313 — bind: bind: Denial of service via assertion failure in RPZ query processing

🎯 Affected products77

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-32:9.16.23-0.22.el8_10.21.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-chroot-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-chroot-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-chroot-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-chroot-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debuginfo-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • bind9.16-debugsource-32:9.16.23-0.22.el8_10.21.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • bind9.16-devel-32:9.16.23-0.22.el8_10.21.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)
  • +47 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, consider disabling DNSSEC validation on `named` resolvers if it is not a strict requirement for your environment. This can be achieved by setting `dnssec-validation no;` in the `named.conf` file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the `named` service must be reloaded or restarted for the changes to take effect. `sudo systemctl reload named` `sudo systemctl restart named` Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients. Workaround: Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies. Alternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL). After modifying the configuration, validate the syntax and reload the service: ``` named-checkconf systemctl reload named ``` Caveats: Aligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups. Warning: Reloading or restarting the `named` service may cause a momentary pause in active DNS query processing.

🔗 References (8)