{"id":"CVE-2026-19630","aliases":["ALPINE-CVE-2026-19630","ALSA-2026:92419","ALSA-2026:93072","ALSA-2026:93610","ALSA-2026:93925","ALSA-2026:94011","AZL-111506","BELL-CVE-2026-19630","DEBIAN-CVE-2026-19630","EUVD-2026-107252","GHSA-53h2-668w-c49r","MGASA-2026-0541","OESA-2026-4664","OESA-2026-4665","OESA-2026-4666","RLSA-2026:92419","RLSA-2026:93072","RLSA-2026:93610","RLSA-2026:93925","RLSA-2026:94011","UBUNTU-CVE-2026-19630","USN-8969-1","openSUSE-SU-2026:12231-1"],"status":"published","title":"Amplified resource exhaustion in inbound message processing","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00448,"percentile":0.39206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-10-21T12:41:04Z","modified":"2026-11-05T14:16:25Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"bind","fixed_in":["9.20.30-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bind9","fixed_in":["1:9.20.30-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bind9","fixed_in":["1:9.20.30-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bind9","fixed_in":["1:9.18.39-0ubuntu0.22.04.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bind9","fixed_in":["1:9.18.39-0ubuntu0.24.04.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"bind9","fixed_in":["1:9.20.24-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bind9","fixed_in":["1:9.20.24-1ubuntu0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bind-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind9.18-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-dnssec-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bind-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-export-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-export-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-libs-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-lite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-pkcs11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-pkcs11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-pkcs11-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-sdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-sdb-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-chroot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-dnssec-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bind9.16-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-bind9.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.20.30-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.11-r0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.20.9-r0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.18.16-r0"},{"fixed":"9.20.30-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.18.12-1","1:9.18.13-1","1:9.18.16-1","1:9.18.16-1~deb12u1","1:9.18.16-1~deb12u1~bpo11+1","1:9.18.19-1~deb12u1","1:9.18.19-1~deb12u1~bpo11+1","1:9.18.24-1","1:9.18.24-1~bpo11+1","1:9.18.28-1~deb12u1","1:9.18.28-1~deb12u2","1:9.18.33-1~deb12u2","1:9.18.41-1~deb12u1","1:9.18.44-1~deb12u1","1:9.18.47-1~deb12u1","1:9.18.49-1~deb12u1","1:9.18.49-1~deb12u2","1:9.19.10-1","1:9.19.11-1","1:9.19.14-1","1:9.19.17-1","1:9.19.19-1","1:9.19.21-1","1:9.19.24-185-g392e7199df2-1","1:9.19.24-2","1:9.19.6-1","1:9.19.6-2","1:9.20.0-1","1:9.20.0-2","1:9.20.1-1","1:9.20.10-1","1:9.20.11-1","1:9.20.11-2","1:9.20.11-3","1:9.20.11-4","1:9.20.11-4~bpo12+1","1:9.20.15-1","1:9.20.15-1~deb13u1","1:9.20.15-1~deb13u1~bpo12+1","1:9.20.15-2","1:9.20.18-1","1:9.20.18-1~deb13u1","1:9.20.18-1~deb13u1~bpo12+1","1:9.20.19-1","1:9.20.19-1~bpo12+1","1:9.20.2-1","1:9.20.20-1","1:9.20.20-1~bpo12+1","1:9.20.21-1","1:9.20.21-1~deb13u1","1:9.20.21-1~deb13u1~bpo12+1","1:9.20.22-1","1:9.20.23-1","1:9.20.23-1~deb13u1","1:9.20.23-1~deb13u1~bpo12+1","1:9.20.24-1","1:9.20.26-1","1:9.20.26-1~deb13u1","1:9.20.26-1~deb13u1~bpo12+1","1:9.20.27-1","1:9.20.27-2","1:9.20.29-1","1:9.20.29-1~deb13u1","1:9.20.3-1","1:9.20.30-1","1:9.20.30-1~deb13u1","1:9.20.4-2","1:9.20.4-3","1:9.20.4-4","1:9.20.5-1","1:9.20.7-1","1:9.20.8-1","1:9.20.8-2","1:9.20.8-3","1:9.20.8-4","1:9.20.8-5","1:9.20.8-6","1:9.20.9-1","1:9.20.9-2","1:9.21.0-1","1:9.21.1-1","1:9.21.10-1","1:9.21.10-10","1:9.21.10-2","1:9.21.10-4","1:9.21.10-5","1:9.21.10-6","1:9.21.10-7","1:9.21.10-8","1:9.21.10-9","1:9.21.14-1","1:9.21.18-1","1:9.21.21-1","1:9.21.22-1","1:9.21.23-1","1:9.21.25-1","1:9.21.26-1","1:9.21.3-1","1:9.21.6-1","1:9.21.7-1","1:9.21.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.30-1~deb13u1"}]}],"versions":["1:9.20.11-4","1:9.20.15-1","1:9.20.15-1~deb13u1","1:9.20.15-1~deb13u1~bpo12+1","1:9.20.15-2","1:9.20.18-1","1:9.20.18-1~deb13u1","1:9.20.18-1~deb13u1~bpo12+1","1:9.20.19-1","1:9.20.19-1~bpo12+1","1:9.20.20-1","1:9.20.20-1~bpo12+1","1:9.20.21-1","1:9.20.21-1~deb13u1","1:9.20.21-1~deb13u1~bpo12+1","1:9.20.22-1","1:9.20.23-1","1:9.20.23-1~deb13u1","1:9.20.23-1~deb13u1~bpo12+1","1:9.20.24-1","1:9.20.26-1","1:9.20.26-1~deb13u1","1:9.20.26-1~deb13u1~bpo12+1","1:9.20.27-1","1:9.20.27-2","1:9.20.29-1","1:9.20.29-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.30-1"}]}],"versions":["1:9.20.11-4","1:9.20.15-1","1:9.20.15-1~deb13u1","1:9.20.15-1~deb13u1~bpo12+1","1:9.20.15-2","1:9.20.18-1","1:9.20.18-1~deb13u1","1:9.20.18-1~deb13u1~bpo12+1","1:9.20.19-1","1:9.20.19-1~bpo12+1","1:9.20.20-1","1:9.20.20-1~bpo12+1","1:9.20.21-1","1:9.20.21-1~deb13u1","1:9.20.21-1~deb13u1~bpo12+1","1:9.20.22-1","1:9.20.23-1","1:9.20.23-1~deb13u1","1:9.20.23-1~deb13u1~bpo12+1","1:9.20.24-1","1:9.20.26-1","1:9.20.26-1~deb13u1","1:9.20.26-1~deb13u1~bpo12+1","1:9.20.27-1","1:9.20.27-2","1:9.20.29-1","1:9.20.29-1~deb13u1","1:9.20.30-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.30-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.21-16.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.18.21-16.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.16.23-34.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.18.33-15.el10_2.14"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bind9.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.18.29-14.el9_8.12"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.16.23-40.el9_8.13"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.11.36-18.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bind9.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.16.23-0.22.el8_10.21"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.9.3.dfsg.P2-4ubuntu1","1:9.9.3.dfsg.P2-4ubuntu2","1:9.9.3.dfsg.P2-4ubuntu3","1:9.9.5.dfsg-2","1:9.9.5.dfsg-3","1:9.9.5.dfsg-3ubuntu0.1","1:9.9.5.dfsg-3ubuntu0.2","1:9.9.5.dfsg-3ubuntu0.3","1:9.9.5.dfsg-3ubuntu0.4","1:9.9.5.dfsg-3ubuntu0.5","1:9.9.5.dfsg-3ubuntu0.6","1:9.9.5.dfsg-3ubuntu0.7","1:9.9.5.dfsg-3ubuntu0.8","1:9.9.5.dfsg-3ubuntu0.9","1:9.9.5.dfsg-3ubuntu0.10","1:9.9.5.dfsg-3ubuntu0.11","1:9.9.5.dfsg-3ubuntu0.12","1:9.9.5.dfsg-3ubuntu0.13","1:9.9.5.dfsg-3ubuntu0.14","1:9.9.5.dfsg-3ubuntu0.15","1:9.9.5.dfsg-3ubuntu0.16","1:9.9.5.dfsg-3ubuntu0.17","1:9.9.5.dfsg-3ubuntu0.18","1:9.9.5.dfsg-3ubuntu0.19","1:9.9.5.dfsg-3ubuntu0.19+esm1","1:9.9.5.dfsg-3ubuntu0.19+esm2","1:9.9.5.dfsg-3ubuntu0.19+esm3","1:9.9.5.dfsg-3ubuntu0.19+esm4","1:9.9.5.dfsg-3ubuntu0.19+esm5","1:9.9.5.dfsg-3ubuntu0.19+esm6","1:9.9.5.dfsg-3ubuntu0.19+esm7","1:9.9.5.dfsg-3ubuntu0.19+esm9","1:9.9.5.dfsg-3ubuntu0.19+esm10","1:9.9.5.dfsg-3ubuntu0.19+esm11","1:9.9.5.dfsg-3ubuntu0.19+esm12","1:9.9.5.dfsg-3ubuntu0.19+esm13","1:9.9.5.dfsg-3ubuntu0.19+esm14","1:9.9.5.dfsg-3ubuntu0.19+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.9.5.dfsg-11ubuntu1","1:9.9.5.dfsg-12","1:9.9.5.dfsg-12.1","1:9.9.5.dfsg-12.1ubuntu1","1:9.10.3.dfsg.P2-4","1:9.10.3.dfsg.P2-5","1:9.10.3.dfsg.P4-3","1:9.10.3.dfsg.P4-4","1:9.10.3.dfsg.P4-5","1:9.10.3.dfsg.P4-8","1:9.10.3.dfsg.P4-8ubuntu1","1:9.10.3.dfsg.P4-8ubuntu1.1","1:9.10.3.dfsg.P4-8ubuntu1.2","1:9.10.3.dfsg.P4-8ubuntu1.3","1:9.10.3.dfsg.P4-8ubuntu1.4","1:9.10.3.dfsg.P4-8ubuntu1.5","1:9.10.3.dfsg.P4-8ubuntu1.6","1:9.10.3.dfsg.P4-8ubuntu1.7","1:9.10.3.dfsg.P4-8ubuntu1.8","1:9.10.3.dfsg.P4-8ubuntu1.9","1:9.10.3.dfsg.P4-8ubuntu1.10","1:9.10.3.dfsg.P4-8ubuntu1.11","1:9.10.3.dfsg.P4-8ubuntu1.12","1:9.10.3.dfsg.P4-8ubuntu1.14","1:9.10.3.dfsg.P4-8ubuntu1.15","1:9.10.3.dfsg.P4-8ubuntu1.16","1:9.10.3.dfsg.P4-8ubuntu1.17","1:9.10.3.dfsg.P4-8ubuntu1.18","1:9.10.3.dfsg.P4-8ubuntu1.19","1:9.10.3.dfsg.P4-8ubuntu1.19+esm1","1:9.10.3.dfsg.P4-8ubuntu1.19+esm2","1:9.10.3.dfsg.P4-8ubuntu1.19+esm3","1:9.10.3.dfsg.P4-8ubuntu1.19+esm5","1:9.10.3.dfsg.P4-8ubuntu1.19+esm6","1:9.10.3.dfsg.P4-8ubuntu1.19+esm7","1:9.10.3.dfsg.P4-8ubuntu1.19+esm8","1:9.10.3.dfsg.P4-8ubuntu1.19+esm9","1:9.10.3.dfsg.P4-8ubuntu1.19+esm10","1:9.10.3.dfsg.P4-8ubuntu1.19+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.10.3.dfsg.P4-12.6ubuntu1","1:9.11.2.P1-1ubuntu2","1:9.11.2.P1-1ubuntu3","1:9.11.2.P1-1ubuntu4","1:9.11.2.P1-1ubuntu5","1:9.11.3+dfsg-1ubuntu1","1:9.11.3+dfsg-1ubuntu1.1","1:9.11.3+dfsg-1ubuntu1.2","1:9.11.3+dfsg-1ubuntu1.3","1:9.11.3+dfsg-1ubuntu1.5","1:9.11.3+dfsg-1ubuntu1.7","1:9.11.3+dfsg-1ubuntu1.8","1:9.11.3+dfsg-1ubuntu1.9","1:9.11.3+dfsg-1ubuntu1.10","1:9.11.3+dfsg-1ubuntu1.11","1:9.11.3+dfsg-1ubuntu1.12","1:9.11.3+dfsg-1ubuntu1.13","1:9.11.3+dfsg-1ubuntu1.14","1:9.11.3+dfsg-1ubuntu1.15","1:9.11.3+dfsg-1ubuntu1.16","1:9.11.3+dfsg-1ubuntu1.17","1:9.11.3+dfsg-1ubuntu1.18","1:9.11.3+dfsg-1ubuntu1.19+esm1","1:9.11.3+dfsg-1ubuntu1.19+esm2","1:9.11.3+dfsg-1ubuntu1.19+esm3","1:9.11.3+dfsg-1ubuntu1.19+esm4","1:9.11.3+dfsg-1ubuntu1.19+esm5","1:9.11.3+dfsg-1ubuntu1.19+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.5-3ubuntu2","4.3.5-3ubuntu3","4.3.5-3ubuntu4","4.3.5-3ubuntu5","4.3.5-3ubuntu6","4.3.5-3ubuntu7","4.3.5-3ubuntu7.1","4.3.5-3ubuntu7.2","4.3.5-3ubuntu7.3","4.3.5-3ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.11.5.P4+dfsg-5.1ubuntu2","1:9.11.5.P4+dfsg-5.1ubuntu3","1:9.11.5.P4+dfsg-5.1ubuntu4","1:9.11.5.P4+dfsg-5.1ubuntu5","1:9.11.14+dfsg-1ubuntu1","1:9.11.14+dfsg-3ubuntu1","1:9.16.0-1ubuntu3","1:9.16.0-1ubuntu4","1:9.16.0-1ubuntu5","1:9.16.1-0ubuntu1","1:9.16.1-0ubuntu2","1:9.16.1-0ubuntu2.1","1:9.16.1-0ubuntu2.2","1:9.16.1-0ubuntu2.3","1:9.16.1-0ubuntu2.4","1:9.16.1-0ubuntu2.6","1:9.16.1-0ubuntu2.7","1:9.16.1-0ubuntu2.8","1:9.16.1-0ubuntu2.9","1:9.16.1-0ubuntu2.10","1:9.16.1-0ubuntu2.11","1:9.16.1-0ubuntu2.12","1:9.16.1-0ubuntu2.14","1:9.16.1-0ubuntu2.15","1:9.16.1-0ubuntu2.16","1:9.16.48-0ubuntu0.20.04.1","1:9.18.28-0ubuntu0.20.04.1","1:9.18.30-0ubuntu0.20.04.1","1:9.18.30-0ubuntu0.20.04.2","1:9.18.30-0ubuntu0.20.04.2+esm1","1:9.18.30-0ubuntu0.20.04.2+esm2","1:9.18.30-0ubuntu0.20.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bind9-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.11.16+dfsg-3~build1","1:9.11.16+dfsg-3~ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.39-0ubuntu0.22.04.8"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1","1:9.18.1-1ubuntu1.2","1:9.18.1-1ubuntu1.3","1:9.18.12-0ubuntu0.22.04.1","1:9.18.12-0ubuntu0.22.04.2","1:9.18.12-0ubuntu0.22.04.3","1:9.18.18-0ubuntu0.22.04.1","1:9.18.18-0ubuntu0.22.04.2","1:9.18.24-0ubuntu0.22.04.1","1:9.18.28-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.2","1:9.18.39-0ubuntu0.22.04.1","1:9.18.39-0ubuntu0.22.04.2","1:9.18.39-0ubuntu0.22.04.3","1:9.18.39-0ubuntu0.22.04.4","1:9.18.39-0ubuntu0.22.04.5","1:9.18.39-0ubuntu0.22.04.6","1:9.18.39-0ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.11.19+dfsg-2.1ubuntu1","1:9.11.19+dfsg-2.1ubuntu2","1:9.11.19+dfsg-2.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.39-0ubuntu0.24.04.9"}]}],"versions":["1:9.18.18-0ubuntu2","1:9.18.21-0ubuntu1","1:9.18.24-0ubuntu3","1:9.18.24-0ubuntu4","1:9.18.24-0ubuntu5","1:9.18.28-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.2","1:9.18.39-0ubuntu0.24.04.1","1:9.18.39-0ubuntu0.24.04.2","1:9.18.39-0ubuntu0.24.04.3","1:9.18.39-0ubuntu0.24.04.5","1:9.18.39-0ubuntu0.24.04.6","1:9.18.39-0ubuntu0.24.04.7","1:9.18.39-0ubuntu0.24.04.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-2ubuntu5","4.4.3-P1-4ubuntu1","4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.24-1ubuntu3.1"}]}],"versions":["1:9.20.18-1ubuntu2","1:9.20.23-1ubuntu1","1:9.20.24-1ubuntu2","1:9.20.24-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.24-1ubuntu0.5"}]}],"versions":["1:9.20.11-1ubuntu2","1:9.20.11-1ubuntu3","1:9.20.18-1ubuntu1","1:9.20.18-1ubuntu2","1:9.20.18-1ubuntu2.1","1:9.20.24-1ubuntu0.1","1:9.20.24-1ubuntu0.2","1:9.20.24-1ubuntu0.3","1:9.20.24-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"isc-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-P1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.39-0ubuntu0.22.04.8"}]}],"versions":["1:9.16.15-1ubuntu1","1:9.16.15-1ubuntu2","1:9.16.15-1ubuntu3","1:9.18.0-2ubuntu1","1:9.18.0-2ubuntu2","1:9.18.0-2ubuntu3","1:9.18.1-1ubuntu1","1:9.18.1-1ubuntu1.1","1:9.18.1-1ubuntu1.2","1:9.18.1-1ubuntu1.3","1:9.18.12-0ubuntu0.22.04.1","1:9.18.12-0ubuntu0.22.04.2","1:9.18.12-0ubuntu0.22.04.3","1:9.18.18-0ubuntu0.22.04.1","1:9.18.18-0ubuntu0.22.04.2","1:9.18.24-0ubuntu0.22.04.1","1:9.18.28-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.1","1:9.18.30-0ubuntu0.22.04.2","1:9.18.39-0ubuntu0.22.04.1","1:9.18.39-0ubuntu0.22.04.2","1:9.18.39-0ubuntu0.22.04.3","1:9.18.39-0ubuntu0.22.04.4","1:9.18.39-0ubuntu0.22.04.5","1:9.18.39-0ubuntu0.22.04.6","1:9.18.39-0ubuntu0.22.04.7"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.39-0ubuntu0.24.04.9"}]}],"versions":["1:9.18.18-0ubuntu2","1:9.18.21-0ubuntu1","1:9.18.24-0ubuntu3","1:9.18.24-0ubuntu4","1:9.18.24-0ubuntu5","1:9.18.28-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.1","1:9.18.30-0ubuntu0.24.04.2","1:9.18.39-0ubuntu0.24.04.1","1:9.18.39-0ubuntu0.24.04.2","1:9.18.39-0ubuntu0.24.04.3","1:9.18.39-0ubuntu0.24.04.5","1:9.18.39-0ubuntu0.24.04.6","1:9.18.39-0ubuntu0.24.04.7","1:9.18.39-0ubuntu0.24.04.8"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.24-1ubuntu3.1"}]}],"versions":["1:9.20.18-1ubuntu2","1:9.20.23-1ubuntu1","1:9.20.24-1ubuntu2","1:9.20.24-1ubuntu3"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.24-1ubuntu0.5"}]}],"versions":["1:9.20.11-1ubuntu2","1:9.20.11-1ubuntu3","1:9.20.18-1ubuntu1","1:9.20.18-1ubuntu2","1:9.20.18-1ubuntu2.1","1:9.20.24-1ubuntu0.1","1:9.20.24-1ubuntu0.2","1:9.20.24-1ubuntu0.3","1:9.20.24-1ubuntu0.4"],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.30-1.1"}]}],"bundled":4}],"products":[{"vendor":"isc","product":"bind 9"}],"references":[{"url":"https://kb.isc.org/docs/cve-2026-19630","tags":["vendor-advisory","web","report"]},{"url":"https://downloads.isc.org/isc/bind9/9.20.30","tags":["patch"]},{"url":"https://downloads.isc.org/isc/bind9/9.21.27","tags":["patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19630","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-53h2-668w-c49r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-19630","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92419","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19630","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94300","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96888","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97313","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556406","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556407","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556415","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-92419.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93072","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-93072.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93610","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-93610.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93925","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19662","tags":["report"]},{"url":"https://bugzilla.redhat.com/2535445","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-93925.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94011","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-94011.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-19630","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19630","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0541.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36559","tags":["report"]},{"url":"https://kb.isc.org/docs/cve-2026-94300","tags":["web"]},{"url":"https://kb.isc.org/docs/cve-2026-96888","tags":["web"]},{"url":"https://kb.isc.org/docs/cve-2026-97313","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94300","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97313","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4665","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92419","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556415","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93072","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93610","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93925","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535445","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94011","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19630","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8969-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-76163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-77119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-77692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-78301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-81736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-96888","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97313","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97313","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-19630","title":"Amplified resource exhaustion in inbound message processing","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T12:41:04.379Z","modified":"2026-10-21T17:19:14.434Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-107252","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T12:41:04Z","modified":"2026-10-21T17:19:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:36.259658Z"}],"ghsa":[{"id":"GHSA-53h2-668w-c49r","title":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in...","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T15:42:28Z","modified":"2026-10-21T15:43:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:14:12.475005Z"}],"nvd":[{"id":"CVE-2026-19630","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T13:18:32.453Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"ALPINE-CVE-2026-19630","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T13:18:32.453Z","modified":"2026-10-23T18:30:02.504283924Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-19630","status":"published","published":"2026-10-22T06:11:58.516105Z","modified":"2026-11-05T07:15:02.47641937Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T09:09:17.982155Z"},{"id":"DEBIAN-CVE-2026-19630","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T13:18:32.453Z","modified":"2026-10-27T09:47:34.551148852Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-4664","title":"bind security update","description":"Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.\r\n\r\nSecurity Fix(es):\n\nIn a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-19630)\n\nReplaying GSS-TSIG signed UDP messages can result in memory corruption in \u0026quot;`named`\u0026quot;.  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-94300)\n\nA BIND resolver that is configured with both a \u0026quot;redirect\u0026quot; zone and \u0026quot;qname-minimization strict\u0026quot; may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-96888)\n\nA recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \u0026quot;recursive-only yes\u0026quot;, and the other with \u0026quot;recursive-only no\u0026quot;.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-97313)","status":"published","published":"2026-11-04T13:54:14Z","modified":"2026-11-04T14:00:04.516648555Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4665","title":"bind security update","description":"Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.\r\n\r\nSecurity Fix(es):\n\nIn a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-19630)\n\nReplaying GSS-TSIG signed UDP messages can result in memory corruption in \u0026quot;`named`\u0026quot;.  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-94300)\n\nA BIND resolver that is configured with both a \u0026quot;redirect\u0026quot; zone and \u0026quot;qname-minimization strict\u0026quot; may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-96888)\n\nA recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \u0026quot;recursive-only yes\u0026quot;, and the other with \u0026quot;recursive-only no\u0026quot;.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-97313)","status":"published","published":"2026-11-04T13:54:15Z","modified":"2026-11-04T14:00:04.823841466Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4666","title":"bind security update","description":"Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.\r\n\r\nSecurity Fix(es):\n\nIn a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-19630)\n\nReplaying GSS-TSIG signed UDP messages can result in memory corruption in \u0026quot;`named`\u0026quot;.  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-94300)\n\nA BIND resolver that is configured with both a \u0026quot;redirect\u0026quot; zone and \u0026quot;qname-minimization strict\u0026quot; may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-96888)\n\nA recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \u0026quot;recursive-only yes\u0026quot;, and the other with \u0026quot;recursive-only no\u0026quot;.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-97313)","status":"published","published":"2026-11-04T13:54:16Z","modified":"2026-11-04T14:00:05.939030513Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"RLSA-2026:92419","title":"Important: bind security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:08:48.996475Z","modified":"2026-10-30T12:30:02.300793894Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:93072","title":"Important: bind9.18 security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.\n\nSecurity Fix(es):\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-01T12:04:04.070768Z","modified":"2026-11-01T12:30:02.545354707Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:93610","title":"Important: bind security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:05:01.276494Z","modified":"2026-11-03T12:30:02.500074639Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"RLSA-2026:93925","title":"Important: bind security, bug fix, and enhancement update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\nBug Fix(es) and Enhancement(s):\n\n* random named crashes on different Rocky Linux 8.10 resolvers after of installing bind-9.11.36-16.el8_10.14 (RHSA-2026:54654) (JIRA:Rocky Linux-257162)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:01:07.151192Z","modified":"2026-11-03T12:30:02.495633698Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"RLSA-2026:94011","title":"Important: bind9.16 security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.\n\nSecurity Fix(es):\n\n* bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)\n\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:01:33.643841Z","modified":"2026-11-03T12:30:04.466912611Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2026-19630","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T13:18:00Z","modified":"2026-11-03T21:19:19.925791759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T21:43:32.336286Z"},{"id":"ALSA-2026:92419","title":"Important: bind security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  \n\nSecurity Fix(es):  \n\n  * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n  * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n  * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n  * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-30T13:30:02.408817401Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:93072","title":"Important: bind9.18 security update","description":"BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.  \n\nSecurity Fix(es):  \n\n  * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n  * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n  * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n  * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-30T00:00:00Z","modified":"2026-10-31T10:45:02.443052388Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:93610","title":"Important: bind security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  \n\nSecurity Fix(es):  \n\n  * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n  * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n  * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n  * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T23:00:02.533984791Z","updated_at":"2026-11-03T00:03:07.015763Z"},{"id":"ALSA-2026:93925","title":"Important: bind security, bug fix, and enhancement update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  \n\nSecurity Fix(es):  \n\n  * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)\n  * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n  * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * random named crashes on different AlmaLinux 8.10 resolvers after of installing bind-9.11.36-16.el8_10.14 (RHSA-2026:54654) (JIRA:RHEL-257162)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-03T12:15:02.399768994Z","updated_at":"2026-11-03T12:31:37.107381Z"},{"id":"ALSA-2026:94011","title":"Important: bind9.16 security update","description":"The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.  \n\nSecurity Fix(es):  \n\n  * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)\n  * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n  * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n  * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n  * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-03T12:15:02.399920974Z","updated_at":"2026-11-03T12:31:37.107381Z"},{"id":"AZL-111506","title":"CVE-2026-19630 affecting package bind 9.20.30-1","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","status":"published","published":"2026-10-21T13:18:32Z","modified":"2026-11-05T14:16:25.949274095Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"MGASA-2026-0541","title":"Updated bind package fixes security vulnerabilities","description":"* In a BIND resolver, inbound DNS protocol messages with a particular\nstructure will result in additional processing, with no limit imposed by\nBIND. A DNS message with a maliciously large number of such structures\nwill cause BIND to consume disproportionate amounts of CPU time and\nmemory during processing (CVE-2026-19630).\n* Replaying GSS-TSIG signed UDP messages can result in memory corruption\nin \"named\". An attacker who can capture a previously signed UDP message\ncan replay it while the negotiated TSIG key is still valid. By also\nsending crafted queries to a zone the attacker controls, the attacker\nmay potentially achieve remote code execution (CVE-2026-94300).\n* A BIND resolver that is configured with both a \"redirect\" zone and\n\"qname-minimization strict\" may abort with an assertion failure while\nprocessing the redirect (CVE-2026-96888).\n* A recursive BIND server that receives a query with recursion desired\n(RD=1) followed by a non-recursive query (RD=0) may exit with an\nassertion failure, resulting in a denial of service. To be vulnerable,\nthe BIND server must allow recursive queries and have at least two RPZ\nzones configured: one with the default setting of \"recursive-only yes\",\nand the other with \"recursive-only no\" (CVE-2026-97313).\n","status":"published","published":"2026-10-25T02:36:50Z","modified":"2026-10-25T02:45:03.399174221Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12231-1","title":"bind-9.20.30-1.1 on GA media","description":"These are all security issues fixed in the bind-9.20.30-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.372668668Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"USN-8969-1","title":"bind9 vulnerabilities","description":"It was discovered that Bind incorrectly handled certain DNS messages\nwith repeated singleton records such as SOA, CNAME, or DNAME records.\nA remote attacker could possibly use this issue to cause Bind to use\nexcessive memory, leading to a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-75029)\n\nIt was discovered that Bind incorrectly handled cached DNSSEC proofs.\nA remote attacker could possibly use this issue to cause Bind to crash,\nresulting in a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-19662)\n\nIt was discovered that Bind incorrectly handled certain invalid DNSSEC\nrecords. A remote attacker could possibly use this issue to cause Bind\nto use excessive CPU resources, leading to a denial of service. This issue only affected\nUbuntu 26.10.\n(CVE-2026-19668)\n\nIt was discovered that Bind incorrectly handled malformed answers on\nresolvers configured to use DNS64. A remote attacker could possibly use\nthis issue to cause Bind to crash, resulting in a denial of service. This issue only affected\nUbuntu 26.10.\n(CVE-2026-19666)\n\nIt was discovered that Bind incorrectly handled TKEY queries when no\nglobal options block was present. A remote attacker could possibly use\nthis issue to cause Bind to crash, resulting in a denial of service.\nThis issue only affected\nUbuntu 26.10.\n(CVE-2026-76163)\n\nIt was discovered that Bind incorrectly verified TSIG signatures during\nzone transfers. A remote attacker could possibly use this issue to inject\nunauthorized zone contents into a secondary server. This issue only affected\nUbuntu 26.10. (CVE-2026-19033)\n\nIt was discovered that Bind incorrectly handled certain NSEC wildcard\nproofs. A remote attacker could possibly use this issue to forge NXDOMAIN\nresponses and hide the existence of wildcard records. This issue only affected\nUbuntu 26.10. (CVE-2026-19941)\n\nIt was discovered that Bind incorrectly handled DNS-over-HTTPS requests\nwith invalid SIG(0) records. A remote attacker could possibly use this\nissue to cause Bind to crash, resulting in a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-77692)\n\nIt was discovered that Bind incorrectly handled malformed zones\ncontaining NS or DNAME nodes above the zone origin. An attacker could\npossibly use this issue to cause Bind to serve out-of-zone records as\nauthoritative, leading to cache poisoning. This issue only affected\nUbuntu 26.10. (CVE-2026-78301)\n\nIt was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode\nrecords referencing large numbers of ServiceMode records. A remote\nattacker could possibly use this issue to cause Bind to exhaust\nresources, leading to a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-81563)\n\nIt was discovered that Bind incorrectly validated NSEC3 records from\nunrelated sibling zones. A remote attacker could possibly use this issue\nto perform a DNSSEC downgrade attack and have forged unsigned answers\naccepted. This issue only affected\nUbuntu 26.10. (CVE-2026-77119)\n\nIt was discovered that Bind incorrectly handled wildcard answers with\nmixed NSEC and NSEC3 proofs. A remote attacker could possibly use this\nissue to cause Bind to crash, resulting in a denial of service. This issue only affected\nUbuntu 26.10.\n(CVE-2026-80274)\n\nIt was discovered that Bind incorrectly handled oversized negative\ncache records. A remote attacker could possibly use this issue to cause\nBind to crash, resulting in a denial of service. This issue only affected\nUbuntu 26.10. (CVE-2026-19667)\n\nIt was discovered that Bind incorrectly handled cached trees of\nSVCB/HTTPS AliasMode records. A remote attacker could possibly use this\nissue to cause Bind to use excessive CPU resources, leading to a denial\nof service. This issue only affected\nUbuntu 26.10. (CVE-2026-81736)\n\nIt was discovered that Bind incorrectly limited the processing of\ncompression pointers in inbound DNS messages. A remote attacker could\npossibly use this issue to cause Bind to use excessive CPU and memory\nresources, leading to a denial of service. (CVE-2026-19630)\n\nIt was discovered that Bind incorrectly serialized access to shared\nGSS-TSIG security contexts. A remote attacker could possibly use this\nissue to corrupt memory and execute arbitrary code. (CVE-2026-94300)\n\nIt was discovered that Bind incorrectly handled redirect zones when\nused together with strict QNAME minimization. A remote attacker could\npossibly use this issue to cause Bind to crash, resulting in a denial\nof service. (CVE-2026-96888)\n\nIt was discovered that Bind incorrectly handled certain RPZ\nconfigurations when processing queries with and without recursion. A\nremote attacker could possibly use this issue to cause Bind to crash,\nresulting in a denial of service. (CVE-2026-97313)","status":"published","published":"2026-11-03T13:45:46Z","modified":"2026-11-03T21:34:46.680070301Z","updated_at":"2026-11-03T22:59:46.019912Z"}]}}