CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10723)

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10822)

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11331)

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11721)

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-12617)

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-13204)

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through…

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10723)

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10822)

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11331)

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11605)

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11622)

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11721)

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the…

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10723)

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-10822)

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11331)

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-11721)

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-12617)

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.(CVE-2026-13204)

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through…

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

• SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records
  • debian/patches/CVE-2025-8677.patch: fail validation on invalid DNSKEY in lib/dns/validator.c.
  • CVE-2025-8677
• SECURITY UPDATE: cache poisoning through forged records in answers
  • debian/patches/CVE-2025-40778.patch: tighten resolver caching rules in lib/dns/resolver.c and lib/dns/message.c, and raise the default max-recursion-queries from 32 to 50 in bin/named/config.c.
  • CVE-2025-40778
• SECURITY UPDATE: assertion failure on malformed PRIVATEDNS DNSKEY records
  • debian/patches/CVE-2026-10822.patch: make dns_name_fromwire() honour the active region of the source buffer in lib/dns/name.c.
  • CVE-2026-10822
• SECURITY UPDATE: crash from malformed NSEC/NSEC3 response
  • debian/patches/CVE-2026-13204.patch: treat a missing NOQNAME proof as an error instead of an assertion failure in lib/dns/rbtdb.c, lib/dns/resolver.c and lib/ns/query.c.
  • CVE-2026-13204
• SECURITY UPDATE: forged DNSSEC-validated NXDOMAIN responses
  • debian/patches/CVE-2026-19941.patch: require NSEC wildcard proofs to be signed by the same zone as the NOQNAME proof in lib/dns/validator.c and lib/dns/include/dns/validator.h.
  • CVE-2026-19941
• SECURITY UPDATE: DNSSEC validation bypass via NSEC3 impersonation
  • debian/patches/CVE-2026-10723.patch: check that the NSEC3 signer matches the owning zone in lib/dns/dnssec.c and lib/isc/result.c.
  • CVE-2026-10723
• SECURITY UPDATE: excessive CPU use validating crafted DNSSEC responses
  • debian/patches/CVE-2026-19668.patch: bound the DS-to-DNSKEY matching during DNSSEC validation and make the exhausted quota terminal in lib/dns/validator.c and lib/dns/resolver.c.
  • CVE-2026-19668
• SECURITY UPDATE: use-after-free of cached NOQNAME proofs
  • debian/patches/CVE-2026-19662.patch: keep the cache slabheader that owns a NOQNAME or closest-encloser proof referenced while the proof rdatasets are in use in lib/dns/rbtdb.c.
  • CVE-2026-19662
• SECURITY UPDATE: out-of-zone data above the apex treated as a zone cut
  • debian/patches/CVE-2026-78301.patch: ignore nodes above the zone origin in RBT zone database lookups in lib/dns/rbtdb.c.
  • CVE-2026-78301
• SECURITY UPDATE: sparsely signed incoming zone transfers accepted
  • debian/patches/CVE-2026-19033.patch: require a TSIG on every message of an incoming zone transfer in lib/dns/xfrin.c.
  • CVE-2026-19033
• SECURITY UPDATE: memory amplification via duplicate singleton records
  • debian/patches/CVE-2026-75029.patch: skip duplicate singleton records when parsing DNS messages in lib/dns/message.c.
  • CVE-2026-75029
• SECURITY UPDATE: DNSSEC downgrade of secure delegations via NSEC3 from an unrelated sibling zone
  • debian/patches/CVE-2026-77119.patch: ignore NSEC3 records whose owner zone does not enclose the DS name in the insecure delegation proof in lib/dns/validator.c.
  • CVE-2026-77119
• SECURITY UPDATE: invalid signed wildcard records accepted
  • debian/patches/CVE-2026-11721.patch: reject RRSIG records whose labels field is lower than the signer label count when parsing and verifying in lib/dns/rdata/generic/rrsig_46.c and lib/dns/dnssec.c, and do not sign out-of-zone records in bin/dnssec/dnssec-signzone.c.
  • CVE-2026-11721

Updated bind packages fix security vulnerabilities: Incorrect acceptance of NSEC3 records. (CVE-2026-10723) Key Record using PRIVATEDNS algorithm may lead to unexpected exit. (CVE-2026-10822) Potential wildcard CNAME RPZ policy bypass. (CVE-2026-11331) Unnecessary validation of DNSSEC signed records. (CVE-2026-11605) Cache poisoning possible with label count discrepancy, RRSIG, and wildcards. (CVE-2026-11721) Record ordering based unexpected exit with CNAME or DNAME. (CVE-2026-12617) Unexpected exit in certain situations with NSEC and NSEC3 both present. (CVE-2026-13204) DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field. (CVE-2026-13321)

These are all security issues fixed in the bind-9.20.26-1.1 package on the GA media of openSUSE Tumbleweed.

This update for bind fixes the following issues

• Upgrade to release 9.20.26
• CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
• CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
• CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
• CVE-2026-11605: Unnecessary validation of DNSSEC signed records (bsc#1271985).
• CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
• CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
• CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
• CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
• CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).

This update for bind fixes the following issues:

Upgrade to release 9.20.26.

Security issues fixed:

• CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
• CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
• CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
• CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
• CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
• CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
• CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
• CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
• CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).

Other updates and bugfixes:

• Release 9.20.26:
  • Reclaim memory promptly when DNSSEC validations are canceled.
  • Removed Features:
    • Remove the secondary validator in query.c.
    • Remove ineffective TCP fallback after repeated UDP timeouts.
  • Feature Changes:
    • Fall back to TCP on receipt of a UDP response with a mismatched query ID.
    • Limit the number of glue records cached from a referral.
    • Fix a resolver stall on a CNAME response to a DS query.
  • Bug Fixes:
    • Fix a bug in DNS UPDATE processing with inline-signing enabled.
    • Properly detect private records before copying.
    • Tighten referral DS acceptance.
    • Don't synthesize negative responses with pending NSEC.
    • Check that an NSEC signer is at or above the name to be validated.
    • Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
    • Fix a deny-answer-aliases configuration bypass issue.
    • Reject external referrals from forwarders.
    • Fix a zone transfer over TLS (XoT) issue when using the opportunistic TLS mode.
    • Unvalidated opt-out NSEC3 could be accepted in insecurity proof.
    • Check wildcard signer and NOQNAME signer match.
    • Fix CNAME resolution failure caused by a cached SERVFAIL response.
    • Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
    • Fix a bug in GeoIP2 string matching.
    • Fix DNS-over-HTTPS (DoH) quota configuration issue.
    • Truncated reply to a TSIG query no longer stalls the resolver.
    • Ignore updates removing DNSKEY RRset with class ANY.
    • Ignore 0-byte reads in the TCP read callback.
    • Only print per-zone glue stats when zone-statistics is set to full.
    • CDS/CDNSKEY records were not removed when re-configuring the server.
    • Fix a crash when querying an empty non-terminal in a wildcard zone in RBTDB.
    • Stop reusing outgoing TCP connections the peer has already closed.
    • Fix DNSSEC validation failures for names under an apex DNAME.
      • The resolver now removes other RRsets at the same name when caching a CNAME.
    • Fix nxdomain-redirect combined with dns64.
    • Fix DNS64 owner case after DNAME restart.
    • Clear REDIRECT flag when it isn't needed.
    • Disable output escaping in bind9.xsl.
    • Fix crash on badly configured secondary signer.
    • Fix a possible crash on concurrent TKEY DELETE for the same key.
    • Reject RRSIG records covering meta-types.

This update for bind fixes the following issues:

• CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones (bsc#1271982).

• CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm identifier length can trigger a consistency check failure (bsc#1271983).

• CVE-2026-11331: handling NAMETOOLONG error conditions incorrectly during RPZ wildcard CNAME processing can allow bypassing RPZ rules or triggering process exits (bsc#1271984).

• CVE-2026-11622: DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage exceeding max-cache-size and affecting response rate (bsc#1271986).

• CVE-2026-11721: RRSIG with fewer labels than its containing zone when synth-from-dnssec is enabled can lead to wildcard generation (bsc#1271987).

• CVE-2026-12617: delayed or specific CNAME/DNAME query responses combined with positive A record responses can trigger an assertion failure (bsc#1271988).

• CVE-2026-13204: validating a domain covered by both NSEC and NSEC3 with an RRSIG for only one type can trigger an assertion failure (bsc#1271989).

• CVE-2026-13321: NSEC records with a Next Domain Name pointing outside the signer's zone can allow cross-zone cache poisoning and authenticated denial-of-service responses (bsc#1271990).

• Update to release 9.18.50:

• Remove ineffective TCP fallback after repeated UDP timeouts.
• Fall back to TCP on receipt of a UDP response with a mismatched query ID.
• Fix DNS64 owner case after DNAME restart.
• Clear REDIRECT flag when it isn't needed.

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331)

It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721)

It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677)

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721)

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033)

It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666)

It was discovered that Bind incorrectly handled oversized negative answers when storing them in the…