RHSA-2026:95478HighCVSS 8.6

Red Hat Security Advisory: bind security, bug fix, and enhancement update

Published
November 5, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (12)

CVE-2026-10723 →CVE-2026-19666 →CVE-2026-80274 →CVE-2026-5946 →CVE-2026-11622 →CVE-2026-11721 →CVE-2026-13204 →CVE-2026-13321 →CVE-2026-19630 →CVE-2026-19667 →CVE-2026-94300 →CVE-2026-3039 →

📋 Description

CVE-2026-3039 — bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-5946 — bind: BIND: Denial of Service via specially crafted DNS messages CVE-2026-10723 — bind: bind9: Incorrect acceptance of NSEC3 records CVE-2026-11622 — bind: bind9: Potential memory usage beyond configured limits CVE-2026-11721 — bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards CVE-2026-13204 — bind: bind9: Unexpected exit with NSEC and NSEC3 both present CVE-2026-13321 — bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19666 — bind: BIND: Denial of Service via malformed DNS64 responses CVE-2026-19667 — bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-80274 — bind: BIND: Denial of Service via crafted DNSSEC reply CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

🎯 Affected products171

  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bind-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-32:9.11.36-8.el8_8.11.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-32:9.11.36-8.el8_8.11.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bind-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • bind-chroot-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-chroot-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-chroot-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-debuginfo-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • bind-debugsource-32:9.11.36-8.el8_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • +141 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Example: ```bash # Edit /etc/named.conf and remove or comment out lines related to tkey-gssapi-keytab or tkey-gssapi-credential. # For example, remove or comment out: # key "gssapi-key" { # algorithm GSSAPI; # secret "BASE64_ENCODED_KEY"; # }; # # Then reload the named service: systemctl reload named ``` Reloading the `named` service may cause a brief interruption in DNS resolution. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Disclaimer: The following mitigation notes are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. ISC states no workarounds exist. Until patched, restrict the resolver to authorized client networks and deploy separate resolvers per trust zone. Memory hardening and auth controls don't apply — this is a DNS protocol logic error using validly-signed records. Workaround: To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services. Workaround: To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers. Example configuration in `named.conf`: ``` options { forwarders { 192.0.2.1; 192.0.2.2; }; forward only; }; ``` Replace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution. Workaround: To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data. Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.

🔗 References (15)