RHSA-2026:95726HighCVSS 8.1

Red Hat Security Advisory: bind security, bug fix, and enhancement update

Published
November 6, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (4)

CVE-2026-19630 →CVE-2026-19666 →CVE-2026-80274 →CVE-2026-94300 →

📋 Description

CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19666 — bind: BIND: Denial of Service via malformed DNS64 responses CVE-2026-80274 — bind: BIND: Denial of Service via crafted DNSSEC reply CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay

🎯 Affected products102

  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-32:9.11.4-26.P2.el7_9.22.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-32:9.11.4-26.P2.el7_9.22.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-32:9.11.4-26.P2.el7_9.22.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-32:9.11.4-26.P2.el7_9.22.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-32:9.11.4-26.P2.el7_9.22.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-chroot-32:9.11.4-26.P2.el7_9.22.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-chroot-32:9.11.4-26.P2.el7_9.22.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-chroot-32:9.11.4-26.P2.el7_9.22.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-chroot-32:9.11.4-26.P2.el7_9.22.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • bind-debuginfo-32:9.11.4-26.P2.el7_9.22.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-devel-32:9.11.4-26.P2.el7_9.22.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-devel-32:9.11.4-26.P2.el7_9.22.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-devel-32:9.11.4-26.P2.el7_9.22.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-devel-32:9.11.4-26.P2.el7_9.22.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • bind-devel-32:9.11.4-26.P2.el7_9.22.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • +72 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services. Workaround: To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data. Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.

🔗 References (7)