Every CVE Search/ Get API key

CVE-2026-76163

named aborts on a TKEY query when the user configuration has no global options statement

7.5 HighFix available

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.57%Up 0.1 points since Sep 17, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

named aborts on a TKEY query when the user configuration has no global options statement

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
EUVDEUVD-2026-80776 7.5

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
EUVD-2026-80776
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-p6fx-3c9f-wcc9 7.5

If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an...

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
GHSA-p6fx-3c9f-wcc9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
NVD 7.5

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSVALPINE-CVE-2026-76163 7.5

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
ALPINE-CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-76163 7.5
Record
BELL-CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-76163 7.5

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
DEBIAN-CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68279 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:68279
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-76163 7.5

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
UBUNTU-CVE-2026-76163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-103350 No score

CVE-2026-76163 affecting package bind for versions less than 9.20.30-1

If BIND is loaded with a "named.conf" file that contains no global "options" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Record
AZL-103350
Updated
2026-11-06
OSVMGASA-2026-0422 No score

Updated bind package fixes security vulnerabilities

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVE-2026-19033). qpcache NOQNAME proof use-after-free crashes recursive resolver (CVE-2026-19662). Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (CVE-2026-19666). Remote assertion failure via 16-bit length truncation in dns_ncache_add() (CVE-2026-19667). Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVE-2026-19668). checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVE-2026-19941). Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVE-2026-75029). named aborts on a TKEY query when the user configuration has no global options statement (CVE-2026-76163). NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVE-2026-77119). Unauthenticated remote crash of named via a single DoH SIG(0) request (CVE-2026-77692). Out-of-zone database nodes can become authoritative zone cuts (CVE-2026-78301). Validating resolver can abort while caching a mismatched NOQNAME proof (CVE-2026-80274). SVCB AliasMode additional-data error leaks qpcache references (CVE-2026-81563). Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVE-2026-81736).

Record
MGASA-2026-0422
Updated
2026-11-02
OSVopenSUSE-SU-2026:11916-1 No score

bind-9.20.29-1.1 on GA media

These are all security issues fixed in the bind-9.20.29-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11916-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22049-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
  • CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
  • CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
  • CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
  • CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
  • CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
  • CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
  • CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
  • CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
  • CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
  • CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
  • CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
  • CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
  • CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

  • Upgrade to release 9.20.29 Feature Changes:
  • Reject oversized and malformed DNSKEY records up front.
  • Speed up RPZ policy zone updates. Bug Fixes:
  • Prevent a crash when using both dns64 and filter-a.
  • Stop passing UDP client addresses to update-policy external helpers.
  • Missing required NSEC3 for delegation not detected.
  • Tighten EUI48 and EUI64 text parsing.
  • GeoIP ACL state could be stale or wrong after reload.
  • Honor DNSSEC policy key tag ranges.
  • Fix a double free in mdig when EDNS options are specified.
  • Fix a crash when an IXFR falls back to AXFR with updates still pending.
  • Fix DS requests to parental agents over TLS.
  • Fix the rndc-confgen -q (quiet) option.
  • Enforce query ACLs for redirect zones and searched DLZs.
  • Check asnum validity in GeoIP ACLs.
  • Fix a crash on remote-servers lists that reference themselves.
  • A record from outside a response policy zone could crash named.
  • Invalid key-store configuration could abort the DNSSEC tools.
  • NSEC signature set could bypass the secure-delegation check.
  • Fix a possible nsupdate issue when using GSS-TSIG.
  • Fix a crash with a single-element geoip sortlist.
  • Prevent out-of-bailiwick CNAMEs from evicting cached records.
  • Restore periodic cleanup of stale resolver address data.
  • Fix named-checkconf/named crash with malformed key name.
  • Prevent resolver crashes while processing DNS over TCP.
  • Ensure NSEC authority does not cross zonecut boundary.
  • Treat an unusable NSEC3 chain as a verification failure.
  • Treat non-canonical RPZ prefixes as any other failure.
  • Negative caching stopped working with stale-answer-client-timeout set to 0.
  • An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
  • Restore SMF support on Solaris and illumos.
  • Fix compilation on GNU/Hurd.
  • dig +yaml was producing invalid YAML when a lookup failed.
  • Properly prevent TSIG generation command line injection attacks.
  • Fix a potential heap bounds overflow write in dnssec-signzone.
  • Fix crashes on invalid DNSTAP input in dnstap-read.
Record
openSUSE-SU-2026:22049-1
Updated
2026-11-02
OSVSUSE-SU-2026:24157-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
  • CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
  • CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
  • CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
  • CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
  • CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
  • CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
  • CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
  • CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
  • CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
  • CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
  • CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
  • CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
  • CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

  • Upgrade to release 9.20.29 Feature Changes:
  • Reject oversized and malformed DNSKEY records up front.
  • Speed up RPZ policy zone updates. Bug Fixes:
  • Prevent a crash when using both dns64 and filter-a.
  • Stop passing UDP client addresses to update-policy external helpers.
  • Missing required NSEC3 for delegation not detected.
  • Tighten EUI48 and EUI64 text parsing.
  • GeoIP ACL state could be stale or wrong after reload.
  • Honor DNSSEC policy key tag ranges.
  • Fix a double free in mdig when EDNS options are specified.
  • Fix a crash when an IXFR falls back to AXFR with updates still pending.
  • Fix DS requests to parental agents over TLS.
  • Fix the rndc-confgen -q (quiet) option.
  • Enforce query ACLs for redirect zones and searched DLZs.
  • Check asnum validity in GeoIP ACLs.
  • Fix a crash on remote-servers lists that reference themselves.
  • A record from outside a response policy zone could crash named.
  • Invalid key-store configuration could abort the DNSSEC tools.
  • NSEC signature set could bypass the secure-delegation check.
  • Fix a possible nsupdate issue when using GSS-TSIG.
  • Fix a crash with a single-element geoip sortlist.
  • Prevent out-of-bailiwick CNAMEs from evicting cached records.
  • Restore periodic cleanup of stale resolver address data.
  • Fix named-checkconf/named crash with malformed key name.
  • Prevent resolver crashes while processing DNS over TCP.
  • Ensure NSEC authority does not cross zonecut boundary.
  • Treat an unusable NSEC3 chain as a verification failure.
  • Treat non-canonical RPZ prefixes as any other failure.
  • Negative caching stopped working with stale-answer-client-timeout set to 0.
  • An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
  • Restore SMF support on Solaris and illumos.
  • Fix compilation on GNU/Hurd.
  • dig +yaml was producing invalid YAML when a lookup failed.
  • Properly prevent TSIG generation command line injection attacks.
  • Fix a potential heap bounds overflow write in dnssec-signzone.
  • Fix crashes on invalid DNSTAP input in dnstap-read.
Record
SUSE-SU-2026:24157-1
Updated
2026-11-02
OSVSUSE-SU-2026:4285-1 No score

Security update for bind

This update for bind fixes the following issues:

  • CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
  • CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
  • CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
  • CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
  • CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
  • CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
  • CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
  • CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
  • CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
  • CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
  • CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
  • CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
  • CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
  • CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

Upgrade to release 9.20.29

New Features:

  • Disclose active Negative Trust Anchors with Extended DNS Error

Feature Changes:

  • Reject oversized and malformed DNSKEY records up front.
  • Speed up RPZ policy zone updates. Bug Fixes:
  • Prevent a crash when using both dns64 and filter-a.
  • Stop passing UDP client addresses to update-policy external helpers.
  • Missing required NSEC3 for delegation not detected.
  • Tighten EUI48 and EUI64 text parsing.
  • GeoIP ACL state could be stale or wrong after reload.
  • Honor DNSSEC policy key tag ranges.
  • Fix a double free in mdig when EDNS options are specified.
  • Fix a crash when an IXFR falls back to AXFR with updates still pending.
  • Fix DS requests to parental agents over TLS.
  • Fix the rndc-confgen -q (quiet) option.
  • Enforce query ACLs for redirect zones and searched DLZs.
  • Check asnum validity in GeoIP ACLs.
  • Fix a crash on remote-servers lists that reference themselves.
  • A record from outside a response policy zone could crash named.
  • Invalid key-store configuration could abort the DNSSEC tools.
  • NSEC signature set could bypass the secure-delegation check.
  • Fix a possible nsupdate issue when using GSS-TSIG.
  • Fix a crash with a single-element geoip sortlist.
  • Prevent out-of-bailiwick CNAMEs from evicting cached records.
  • Restore periodic cleanup of stale resolver address data.
  • Fix named-checkconf/named crash with malformed key name.
  • Prevent resolver crashes while processing DNS over TCP.
  • Ensure NSEC authority does not cross zonecut boundary.
  • Treat an unusable NSEC3 chain as a verification failure.
  • Treat non-canonical RPZ prefixes as any other failure.
  • Negative caching stopped working with stale-answer-client-timeout set to 0.
  • An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
  • Restore SMF support on Solaris and illumos.
  • Fix compilation on GNU/Hurd.
  • dig +yaml was producing invalid YAML when a lookup failed.
  • Properly prevent TSIG generation command line injection attacks.
  • Fix a potential heap bounds overflow write in dnssec-signzone.
  • Fix crashes on invalid DNSTAP input in dnstap-read.
Record
SUSE-SU-2026:4285-1
Updated
2026-11-02
OSVUSN-8929-1 No score

bind9 vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677)

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721)

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033)

It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666)

It was discovered that Bind incorrectly handled oversized negative answers when storing them in the…

Record
USN-8929-1
Updated
2026-11-02
OSVUSN-8969-1 No score

bind9 vulnerabilities

It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19668)

It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19666)

It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-76163)

It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue only affected Ubuntu 26.10. (CVE-2026-19033)

It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue only affected Ubuntu 26.10. (CVE-2026-19941)

It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-77692)

It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-80274)

It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19667)

It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory…

Record
USN-8969-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.22
 before 9.20.29-r0
9.20.29-r0
bind
Alpine:v3.23
 before 9.20.29-r0
9.20.29-r0
bind
Alpine:v3.24
 before 9.20.29-r0
9.20.29-r0
bind
Azure Linux:3
 before 9.20.30-1
9.20.30-1
bind
Alpaquita:23
 9.18.11-r0 up to 9.20.29-r0
9.20.29-r0
bind
Alpaquita:25
 9.20.9-r0 up to 9.20.29-r0
9.20.29-r0
bind
Alpaquita:stream
 9.18.16-r0 up to 9.20.29-r0
9.20.29-r0
bind9
Debian:12
 All versions, plus listed versions
1:9.18.12-11:9.18.13-11:9.18.16-11:9.18.16-1~deb12u11:9.18.16-1~deb12u1~bpo11+1
Show 45 moreShow less
1:9.18.19-1~deb12u11:9.18.19-1~deb12u1~bpo11+11:9.18.24-11:9.18.24-1~bpo11+11:9.18.28-1~deb12u11:9.18.28-1~deb12u21:9.18.33-1~deb12u21:9.18.41-1~deb12u11:9.18.44-1~deb12u11:9.18.47-1~deb12u11:9.18.49-1~deb12u11:9.18.49-1~deb12u21:9.19.10-11:9.19.11-11:9.19.14-11:9.19.17-11:9.19.19-11:9.19.21-11:9.19.24-185-g392e7199df2-11:9.19.24-21:9.19.6-11:9.19.6-21:9.20.0-11:9.20.0-21:9.20.1-11:9.20.10-11:9.20.11-11:9.20.11-21:9.20.11-31:9.20.11-41:9.20.11-4~bpo12+11:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-21:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.2-11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u1
 None known
bind9
Debian:13
 before 1:9.20.29-1~deb13u1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 20 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-11:9.20.23-1~deb13u11:9.20.23-1~deb13u1~bpo12+11:9.20.24-11:9.20.26-11:9.20.26-1~deb13u11:9.20.26-1~deb13u1~bpo12+11:9.20.27-11:9.20.27-2
1:9.20.29-1~deb13u1
bind9
Debian:14
 before 1:9.20.29-1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 21 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-11:9.20.23-1~deb13u11:9.20.23-1~deb13u1~bpo12+11:9.20.24-11:9.20.26-11:9.20.26-1~deb13u11:9.20.26-1~deb13u1~bpo12+11:9.20.27-11:9.20.27-21:9.20.29-1~deb13u1
1:9.20.29-1
Show 32 moreShow less
Affected packages
PackageAffectedFixed
bind
Mageia:10
From an advisory covering 14 CVEs
 before 9.20.29-1.mga10
9.20.29-1.mga10
bind
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-chroot
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-devel
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-dnssec-utils
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-doc
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-libs
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind-utils
Red Hat:hummingbird:1
From an advisory covering 14 CVEs
 before 0:9.20.29-0.1.hum1
0:9.20.29-0.1.hum1
bind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 14 CVEs
 before 9.20.29-160000.1.1
9.20.29-160000.1.1
bind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 14 CVEs
 before 9.20.29-160000.1.1
9.20.29-160000.1.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 14 CVEs
 before 9.20.29-150700.3.32.2
9.20.29-150700.3.32.2
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 14 CVEs
 before 9.20.29-150700.3.32.2
9.20.29-150700.3.32.2
isc-dhcp
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.3.5-3ubuntu24.3.5-3ubuntu34.3.5-3ubuntu44.3.5-3ubuntu54.3.5-3ubuntu6
Show 5 moreShow less
4.3.5-3ubuntu74.3.5-3ubuntu7.14.3.5-3ubuntu7.24.3.5-3ubuntu7.34.3.5-3ubuntu7.4
 None known
bind9-libs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:9.11.16+dfsg-3~build11:9.11.16+dfsg-3~ubuntu1
 None known
bind9-libs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:9.11.19+dfsg-2.1ubuntu11:9.11.19+dfsg-2.1ubuntu21:9.11.19+dfsg-2.1ubuntu3
 None known
isc-dhcp
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.3-P1-2ubuntu54.4.3-P1-4ubuntu14.4.3-P1-4ubuntu2
 None known
bind9
Ubuntu:26.10
 before 1:9.20.24-1ubuntu3.1, plus listed versions
1:9.20.18-1ubuntu21:9.20.23-1ubuntu11:9.20.24-1ubuntu21:9.20.24-1ubuntu3
1:9.20.24-1ubuntu3.1
bind9
Ubuntu:26.04:LTS
 before 1:9.20.24-1ubuntu0.4, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu21:9.20.18-1ubuntu2.11:9.20.24-1ubuntu0.11:9.20.24-1ubuntu0.21:9.20.24-1ubuntu0.3
1:9.20.24-1ubuntu0.4
isc-dhcp
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.3-P1-4ubuntu2
 None known
bind9
Ubuntu:Pro:14.04:LTS
From an advisory covering 24 CVEs
 before 1:9.9.5.dfsg-3ubuntu0.19+esm15, plus listed versions
1:9.9.3.dfsg.P2-4ubuntu11:9.9.3.dfsg.P2-4ubuntu21:9.9.3.dfsg.P2-4ubuntu31:9.9.5.dfsg-21:9.9.5.dfsg-3
Show 32 moreShow less
1:9.9.5.dfsg-3ubuntu0.11:9.9.5.dfsg-3ubuntu0.21:9.9.5.dfsg-3ubuntu0.31:9.9.5.dfsg-3ubuntu0.41:9.9.5.dfsg-3ubuntu0.51:9.9.5.dfsg-3ubuntu0.61:9.9.5.dfsg-3ubuntu0.71:9.9.5.dfsg-3ubuntu0.81:9.9.5.dfsg-3ubuntu0.91:9.9.5.dfsg-3ubuntu0.101:9.9.5.dfsg-3ubuntu0.111:9.9.5.dfsg-3ubuntu0.121:9.9.5.dfsg-3ubuntu0.131:9.9.5.dfsg-3ubuntu0.141:9.9.5.dfsg-3ubuntu0.151:9.9.5.dfsg-3ubuntu0.161:9.9.5.dfsg-3ubuntu0.171:9.9.5.dfsg-3ubuntu0.181:9.9.5.dfsg-3ubuntu0.191:9.9.5.dfsg-3ubuntu0.19+esm11:9.9.5.dfsg-3ubuntu0.19+esm21:9.9.5.dfsg-3ubuntu0.19+esm31:9.9.5.dfsg-3ubuntu0.19+esm41:9.9.5.dfsg-3ubuntu0.19+esm51:9.9.5.dfsg-3ubuntu0.19+esm61:9.9.5.dfsg-3ubuntu0.19+esm71:9.9.5.dfsg-3ubuntu0.19+esm91:9.9.5.dfsg-3ubuntu0.19+esm101:9.9.5.dfsg-3ubuntu0.19+esm111:9.9.5.dfsg-3ubuntu0.19+esm121:9.9.5.dfsg-3ubuntu0.19+esm131:9.9.5.dfsg-3ubuntu0.19+esm14
1:9.9.5.dfsg-3ubuntu0.19+esm15
bind9
Ubuntu:Pro:16.04:LTS
From an advisory covering 24 CVEs
 before 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11, plus listed versions
1:9.9.5.dfsg-11ubuntu11:9.9.5.dfsg-121:9.9.5.dfsg-12.11:9.9.5.dfsg-12.1ubuntu11:9.10.3.dfsg.P2-4
Show 33 moreShow less
1:9.10.3.dfsg.P2-51:9.10.3.dfsg.P4-31:9.10.3.dfsg.P4-41:9.10.3.dfsg.P4-51:9.10.3.dfsg.P4-81:9.10.3.dfsg.P4-8ubuntu11:9.10.3.dfsg.P4-8ubuntu1.11:9.10.3.dfsg.P4-8ubuntu1.21:9.10.3.dfsg.P4-8ubuntu1.31:9.10.3.dfsg.P4-8ubuntu1.41:9.10.3.dfsg.P4-8ubuntu1.51:9.10.3.dfsg.P4-8ubuntu1.61:9.10.3.dfsg.P4-8ubuntu1.71:9.10.3.dfsg.P4-8ubuntu1.81:9.10.3.dfsg.P4-8ubuntu1.91:9.10.3.dfsg.P4-8ubuntu1.101:9.10.3.dfsg.P4-8ubuntu1.111:9.10.3.dfsg.P4-8ubuntu1.121:9.10.3.dfsg.P4-8ubuntu1.141:9.10.3.dfsg.P4-8ubuntu1.151:9.10.3.dfsg.P4-8ubuntu1.161:9.10.3.dfsg.P4-8ubuntu1.171:9.10.3.dfsg.P4-8ubuntu1.181:9.10.3.dfsg.P4-8ubuntu1.191:9.10.3.dfsg.P4-8ubuntu1.19+esm11:9.10.3.dfsg.P4-8ubuntu1.19+esm21:9.10.3.dfsg.P4-8ubuntu1.19+esm31:9.10.3.dfsg.P4-8ubuntu1.19+esm51:9.10.3.dfsg.P4-8ubuntu1.19+esm61:9.10.3.dfsg.P4-8ubuntu1.19+esm71:9.10.3.dfsg.P4-8ubuntu1.19+esm81:9.10.3.dfsg.P4-8ubuntu1.19+esm91:9.10.3.dfsg.P4-8ubuntu1.19+esm10
1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
bind9
Ubuntu:Pro:18.04:LTS
From an advisory covering 24 CVEs
 before 1:9.11.3+dfsg-1ubuntu1.19+esm6, plus listed versions
1:9.10.3.dfsg.P4-12.6ubuntu11:9.11.2.P1-1ubuntu21:9.11.2.P1-1ubuntu31:9.11.2.P1-1ubuntu41:9.11.2.P1-1ubuntu5
Show 22 moreShow less
1:9.11.3+dfsg-1ubuntu11:9.11.3+dfsg-1ubuntu1.11:9.11.3+dfsg-1ubuntu1.21:9.11.3+dfsg-1ubuntu1.31:9.11.3+dfsg-1ubuntu1.51:9.11.3+dfsg-1ubuntu1.71:9.11.3+dfsg-1ubuntu1.81:9.11.3+dfsg-1ubuntu1.91:9.11.3+dfsg-1ubuntu1.101:9.11.3+dfsg-1ubuntu1.111:9.11.3+dfsg-1ubuntu1.121:9.11.3+dfsg-1ubuntu1.131:9.11.3+dfsg-1ubuntu1.141:9.11.3+dfsg-1ubuntu1.151:9.11.3+dfsg-1ubuntu1.161:9.11.3+dfsg-1ubuntu1.171:9.11.3+dfsg-1ubuntu1.181:9.11.3+dfsg-1ubuntu1.19+esm11:9.11.3+dfsg-1ubuntu1.19+esm21:9.11.3+dfsg-1ubuntu1.19+esm31:9.11.3+dfsg-1ubuntu1.19+esm41:9.11.3+dfsg-1ubuntu1.19+esm5
1:9.11.3+dfsg-1ubuntu1.19+esm6
bind9
Ubuntu:Pro:20.04:LTS
From an advisory covering 24 CVEs
 before 1:9.18.30-0ubuntu0.20.04.2+esm3, plus listed versions
1:9.11.5.P4+dfsg-5.1ubuntu21:9.11.5.P4+dfsg-5.1ubuntu31:9.11.5.P4+dfsg-5.1ubuntu41:9.11.5.P4+dfsg-5.1ubuntu51:9.11.14+dfsg-1ubuntu1
Show 26 moreShow less
1:9.11.14+dfsg-3ubuntu11:9.16.0-1ubuntu31:9.16.0-1ubuntu41:9.16.0-1ubuntu51:9.16.1-0ubuntu11:9.16.1-0ubuntu21:9.16.1-0ubuntu2.11:9.16.1-0ubuntu2.21:9.16.1-0ubuntu2.31:9.16.1-0ubuntu2.41:9.16.1-0ubuntu2.61:9.16.1-0ubuntu2.71:9.16.1-0ubuntu2.81:9.16.1-0ubuntu2.91:9.16.1-0ubuntu2.101:9.16.1-0ubuntu2.111:9.16.1-0ubuntu2.121:9.16.1-0ubuntu2.141:9.16.1-0ubuntu2.151:9.16.1-0ubuntu2.161:9.16.48-0ubuntu0.20.04.11:9.18.28-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.11:9.18.30-0ubuntu0.20.04.21:9.18.30-0ubuntu0.20.04.2+esm11:9.18.30-0ubuntu0.20.04.2+esm2
1:9.18.30-0ubuntu0.20.04.2+esm3
bind9
Ubuntu:22.04:LTS
From an advisory covering 24 CVEs
 before 1:9.18.39-0ubuntu0.22.04.7, plus listed versions
1:9.16.15-1ubuntu11:9.16.15-1ubuntu21:9.16.15-1ubuntu31:9.18.0-2ubuntu11:9.18.0-2ubuntu2
Show 20 moreShow less
1:9.18.0-2ubuntu31:9.18.1-1ubuntu11:9.18.1-1ubuntu1.11:9.18.1-1ubuntu1.21:9.18.1-1ubuntu1.31:9.18.12-0ubuntu0.22.04.11:9.18.12-0ubuntu0.22.04.21:9.18.12-0ubuntu0.22.04.31:9.18.18-0ubuntu0.22.04.11:9.18.18-0ubuntu0.22.04.21:9.18.24-0ubuntu0.22.04.11:9.18.28-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.11:9.18.39-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.31:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.51:9.18.39-0ubuntu0.22.04.6
1:9.18.39-0ubuntu0.22.04.7
bind9
Ubuntu:24.04:LTS
From an advisory covering 24 CVEs
 before 1:9.18.39-0ubuntu0.24.04.8, plus listed versions
1:9.18.18-0ubuntu21:9.18.21-0ubuntu11:9.18.24-0ubuntu31:9.18.24-0ubuntu41:9.18.24-0ubuntu5
Show 9 moreShow less
1:9.18.28-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.11:9.18.39-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.31:9.18.39-0ubuntu0.24.04.51:9.18.39-0ubuntu0.24.04.61:9.18.39-0ubuntu0.24.04.7
1:9.18.39-0ubuntu0.24.04.8
bind9
Ubuntu:26.04:LTS
From an advisory covering 24 CVEs
 before 1:9.20.24-1ubuntu0.4, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu21:9.20.18-1ubuntu2.11:9.20.24-1ubuntu0.11:9.20.24-1ubuntu0.21:9.20.24-1ubuntu0.3
1:9.20.24-1ubuntu0.4
bind9
Ubuntu:22.04:LTS
From an advisory covering 18 CVEs
 before 1:9.18.39-0ubuntu0.22.04.8, plus listed versions
1:9.16.15-1ubuntu11:9.16.15-1ubuntu21:9.16.15-1ubuntu31:9.18.0-2ubuntu11:9.18.0-2ubuntu2
Show 21 moreShow less
1:9.18.0-2ubuntu31:9.18.1-1ubuntu11:9.18.1-1ubuntu1.11:9.18.1-1ubuntu1.21:9.18.1-1ubuntu1.31:9.18.12-0ubuntu0.22.04.11:9.18.12-0ubuntu0.22.04.21:9.18.12-0ubuntu0.22.04.31:9.18.18-0ubuntu0.22.04.11:9.18.18-0ubuntu0.22.04.21:9.18.24-0ubuntu0.22.04.11:9.18.28-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.11:9.18.39-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.31:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.51:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.7
1:9.18.39-0ubuntu0.22.04.8
bind9
Ubuntu:24.04:LTS
From an advisory covering 18 CVEs
 before 1:9.18.39-0ubuntu0.24.04.9, plus listed versions
1:9.18.18-0ubuntu21:9.18.21-0ubuntu11:9.18.24-0ubuntu31:9.18.24-0ubuntu41:9.18.24-0ubuntu5
Show 10 moreShow less
1:9.18.28-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.11:9.18.39-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.31:9.18.39-0ubuntu0.24.04.51:9.18.39-0ubuntu0.24.04.61:9.18.39-0ubuntu0.24.04.71:9.18.39-0ubuntu0.24.04.8
1:9.18.39-0ubuntu0.24.04.9
bind9
Ubuntu:26.10
From an advisory covering 18 CVEs
 before 1:9.20.24-1ubuntu3.1, plus listed versions
1:9.20.18-1ubuntu21:9.20.23-1ubuntu11:9.20.24-1ubuntu21:9.20.24-1ubuntu3
1:9.20.24-1ubuntu3.1
bind9
Ubuntu:26.04:LTS
From an advisory covering 18 CVEs
 before 1:9.20.24-1ubuntu0.5, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu21:9.20.18-1ubuntu2.1
Show 4 moreShow less
1:9.20.24-1ubuntu0.11:9.20.24-1ubuntu0.21:9.20.24-1ubuntu0.31:9.20.24-1ubuntu0.4
1:9.20.24-1ubuntu0.5
bind
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 9.20.29-1.1
9.20.29-1.1
bind
openSUSE:Leap 16.0
From an advisory covering 14 CVEs
 before 9.20.29-160000.1.1
9.20.29-160000.1.1

History

History
RecordedChangedSources
affectedOSV
affectedOSV
affected, aliases, referencesOSV
affected, facts, referencesOSV
affected, aliases, references
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-76163 is a high vulnerability (CVSS 7.5) in Isc Bind 9, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in bind 9.20.29-r0.

References

Show 136 moreShow less
This page doesn't list everything

Left out here: 51 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open