CVE-2026-81563

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-80274)

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81563)

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81736)

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-80274)

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81563)

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81736)

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-80274)

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81563)

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.(CVE-2026-81736)

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736)

• bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)

• bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563)

• bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)

• bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

• bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736)

• bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)

• bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563)

• bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)

• bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

• bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736)
• bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)
• bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563)
• bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
• bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

• bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736)
• bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667)
• bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563)
• bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
• bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVE-2026-19033). qpcache NOQNAME proof use-after-free crashes recursive resolver (CVE-2026-19662). Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (CVE-2026-19666). Remote assertion failure via 16-bit length truncation in dns_ncache_add() (CVE-2026-19667). Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVE-2026-19668). checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVE-2026-19941). Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVE-2026-75029). named aborts on a TKEY query when the user configuration has no global options statement (CVE-2026-76163). NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVE-2026-77119). Unauthenticated remote crash of named via a single DoH SIG(0) request (CVE-2026-77692). Out-of-zone database nodes can become authoritative zone cuts (CVE-2026-78301). Validating resolver can abort while caching a mismatched NOQNAME proof (CVE-2026-80274). SVCB AliasMode additional-data error leaks qpcache references (CVE-2026-81563). Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVE-2026-81736).

These are all security issues fixed in the bind-9.20.29-1.1 package on the GA media of openSUSE Tumbleweed.

This update for bind fixes the following issues:

• CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
• CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
• CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
• CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
• CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
• CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
• CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
• CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
• CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
• CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
• CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
• CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
• CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
• CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

• Upgrade to release 9.20.29 Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Speed up RPZ policy zone updates. Bug Fixes:
• Prevent a crash when using both dns64 and filter-a.
• Stop passing UDP client addresses to update-policy external helpers.
• Missing required NSEC3 for delegation not detected.
• Tighten EUI48 and EUI64 text parsing.
• GeoIP ACL state could be stale or wrong after reload.
• Honor DNSSEC policy key tag ranges.
• Fix a double free in mdig when EDNS options are specified.
• Fix a crash when an IXFR falls back to AXFR with updates still pending.
• Fix DS requests to parental agents over TLS.
• Fix the rndc-confgen -q (quiet) option.
• Enforce query ACLs for redirect zones and searched DLZs.
• Check asnum validity in GeoIP ACLs.
• Fix a crash on remote-servers lists that reference themselves.
• A record from outside a response policy zone could crash named.
• Invalid key-store configuration could abort the DNSSEC tools.
• NSEC signature set could bypass the secure-delegation check.
• Fix a possible nsupdate issue when using GSS-TSIG.
• Fix a crash with a single-element geoip sortlist.
• Prevent out-of-bailiwick CNAMEs from evicting cached records.
• Restore periodic cleanup of stale resolver address data.
• Fix named-checkconf/named crash with malformed key name.
• Prevent resolver crashes while processing DNS over TCP.
• Ensure NSEC authority does not cross zonecut boundary.
• Treat an unusable NSEC3 chain as a verification failure.
• Treat non-canonical RPZ prefixes as any other failure.
• Negative caching stopped working with stale-answer-client-timeout set to 0.
• An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
• Restore SMF support on Solaris and illumos.
• Fix compilation on GNU/Hurd.
• dig +yaml was producing invalid YAML when a lookup failed.
• Properly prevent TSIG generation command line injection attacks.
• Fix a potential heap bounds overflow write in dnssec-signzone.
• Fix crashes on invalid DNSTAP input in dnstap-read.

This update for bind fixes the following issues:

• CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
• CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
• CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
• CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
• CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
• CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
• CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
• CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
• CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
• CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
• CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
• CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
• CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
• CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

• Upgrade to release 9.20.29 Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Speed up RPZ policy zone updates. Bug Fixes:
• Prevent a crash when using both dns64 and filter-a.
• Stop passing UDP client addresses to update-policy external helpers.
• Missing required NSEC3 for delegation not detected.
• Tighten EUI48 and EUI64 text parsing.
• GeoIP ACL state could be stale or wrong after reload.
• Honor DNSSEC policy key tag ranges.
• Fix a double free in mdig when EDNS options are specified.
• Fix a crash when an IXFR falls back to AXFR with updates still pending.
• Fix DS requests to parental agents over TLS.
• Fix the rndc-confgen -q (quiet) option.
• Enforce query ACLs for redirect zones and searched DLZs.
• Check asnum validity in GeoIP ACLs.
• Fix a crash on remote-servers lists that reference themselves.
• A record from outside a response policy zone could crash named.
• Invalid key-store configuration could abort the DNSSEC tools.
• NSEC signature set could bypass the secure-delegation check.
• Fix a possible nsupdate issue when using GSS-TSIG.
• Fix a crash with a single-element geoip sortlist.
• Prevent out-of-bailiwick CNAMEs from evicting cached records.
• Restore periodic cleanup of stale resolver address data.
• Fix named-checkconf/named crash with malformed key name.
• Prevent resolver crashes while processing DNS over TCP.
• Ensure NSEC authority does not cross zonecut boundary.
• Treat an unusable NSEC3 chain as a verification failure.
• Treat non-canonical RPZ prefixes as any other failure.
• Negative caching stopped working with stale-answer-client-timeout set to 0.
• An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
• Restore SMF support on Solaris and illumos.
• Fix compilation on GNU/Hurd.
• dig +yaml was producing invalid YAML when a lookup failed.
• Properly prevent TSIG generation command line injection attacks.
• Fix a potential heap bounds overflow write in dnssec-signzone.
• Fix crashes on invalid DNSTAP input in dnstap-read.

This update for bind fixes the following issues:

• CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
• CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
• CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
• CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
• CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
• CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
• CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
• CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement (bsc#1280439).
• CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
• CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
• CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
• CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
• CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
• CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Changes for bind:

Upgrade to release 9.20.29

New Features:

• Disclose active Negative Trust Anchors with Extended DNS Error

Feature Changes:

• Reject oversized and malformed DNSKEY records up front.
• Speed up RPZ policy zone updates. Bug Fixes:
• Prevent a crash when using both dns64 and filter-a.
• Stop passing UDP client addresses to update-policy external helpers.
• Missing required NSEC3 for delegation not detected.
• Tighten EUI48 and EUI64 text parsing.
• GeoIP ACL state could be stale or wrong after reload.
• Honor DNSSEC policy key tag ranges.
• Fix a double free in mdig when EDNS options are specified.
• Fix a crash when an IXFR falls back to AXFR with updates still pending.
• Fix DS requests to parental agents over TLS.
• Fix the rndc-confgen -q (quiet) option.
• Enforce query ACLs for redirect zones and searched DLZs.
• Check asnum validity in GeoIP ACLs.
• Fix a crash on remote-servers lists that reference themselves.
• A record from outside a response policy zone could crash named.
• Invalid key-store configuration could abort the DNSSEC tools.
• NSEC signature set could bypass the secure-delegation check.
• Fix a possible nsupdate issue when using GSS-TSIG.
• Fix a crash with a single-element geoip sortlist.
• Prevent out-of-bailiwick CNAMEs from evicting cached records.
• Restore periodic cleanup of stale resolver address data.
• Fix named-checkconf/named crash with malformed key name.
• Prevent resolver crashes while processing DNS over TCP.
• Ensure NSEC authority does not cross zonecut boundary.
• Treat an unusable NSEC3 chain as a verification failure.
• Treat non-canonical RPZ prefixes as any other failure.
• Negative caching stopped working with stale-answer-client-timeout set to 0.
• An unterminated OpenSSL private-key Label: field could be read past its parser buffer.
• Restore SMF support on Solaris and illumos.
• Fix compilation on GNU/Hurd.
• dig +yaml was producing invalid YAML when a lookup failed.
• Properly prevent TSIG generation command line injection attacks.
• Fix a potential heap bounds overflow write in dnssec-signzone.
• Fix crashes on invalid DNSTAP input in dnstap-read.

This update for bind fixes the following issues:

• CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
• CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
• CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
• CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
• CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437).
• CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438).
• CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
• CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
• CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
• CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677)

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721)

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033)

It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666)

It was discovered that Bind incorrectly handled oversized negative answers when storing them in the…

It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19668)

It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19666)

It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-76163)

It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue only affected Ubuntu 26.10. (CVE-2026-19033)

It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue only affected Ubuntu 26.10. (CVE-2026-19941)

It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-77692)

It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-80274)

It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19667)

It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory…