RHSA-2026:94277HighCVSS 8.1

Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement update

Published
November 3, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (8)

CVE-2026-80274 →CVE-2026-94300 →CVE-2026-96888 →CVE-2026-97313 →CVE-2026-5946 →CVE-2026-19630 →CVE-2026-19666 →CVE-2026-19667 →

📋 Description

CVE-2026-5946 — bind: BIND: Denial of Service via specially crafted DNS messages CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19666 — bind: BIND: Denial of Service via malformed DNS64 responses CVE-2026-19667 — bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-80274 — bind: BIND: Denial of Service via crafted DNSSEC reply CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-96888 — bind: bind: Denial of Service via assertion failure during redirect processing CVE-2026-97313 — bind: bind: Denial of service via assertion failure in RPZ query processing

🎯 Affected products24

  • Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-32:9.16.23-0.7.el8_6.12.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-32:9.16.23-0.7.el8_6.12.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-chroot-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-chroot-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-debugsource-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-debugsource-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-dnssec-utils-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-dnssec-utils-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-libs-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-libs-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-libs-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-libs-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-license-32:9.16.23-0.7.el8_6.12.noarch as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-license-32:9.16.23-0.7.el8_6.12.noarch as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-utils-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-utils-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • bind9.16-utils-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • bind9.16-utils-debuginfo-32:9.16.23-0.7.el8_6.12.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services. Workaround: To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers. Example configuration in `named.conf`: ``` options { forwarders { 192.0.2.1; 192.0.2.2; }; forward only; }; ``` Replace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution. Workaround: To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data. Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients. Workaround: Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies. Alternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL). After modifying the configuration, validate the syntax and reload the service: ``` named-checkconf systemctl reload named ``` Caveats: Aligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups. Warning: Reloading or restarting the `named` service may cause a momentary pause in active DNS query processing.

🔗 References (11)