PatchFirst · Aktuelle Sicherheitslücken
In den letzten 30 Tagen veröffentlichte Sicherheitslücke für bind: 1. Davon im KEV-Katalog: 0.
Sicherheitslücken: 13
This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435). - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435). - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436). - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildc
This update for bind fixes the following issues: - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982). - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984). - CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986). - CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987). - CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989). - CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).
This update for bind fixes the following issues: Upgrade to release 9.20.26. Security issues fixed: - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982). - CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983). - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984). - CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985). - CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986). - CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987). - CVE-2026-12617: record order
This update for bind fixes the following issues: - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591). - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592). - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
This update for bind fixes the following issues: Security issues: - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591). - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592). - CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593). - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594). - CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595). - CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596). Non security issue: - bind test failed with versi
This update for bind fixes the following issues: - CVE-2026-1519: high CPU load during insecure delegation validation due to excessive NSEC3 iterations (bsc#1260805).
This update for bind fixes the following issues: Security issues: - CVE-2026-1519: maliciously crafted DNSSEC-validated zone can lead to denial of service (bsc#1260805). - CVE-2026-3104: memory leak in code preparing DNSSEC proofs of non-existence allows for DoS (bsc#1260567). - CVE-2026-3119: authenticated queries containing a TKEY record may cause `named` to terminate unexpectedly (bsc#1260568). - CVE-2026-3591: stack use-after-return flaw in SIG(0) handling code allows for ACL bypass (bsc#1260569). - use-after-free error in `dns_client_resolve()` triggered by a DNAME response (bsc#1259202). Upgrade to release 9.20.21 Security Fixes:
This update for bind fixes the following issues: Upgrade to release 9.20.18: - CVE-2025-13878: Fixed incorrect length checks for BRID and HHIT records (bsc#1256997) Feature Changes: * Add more information to the rndc recursing output about fetches. * Reduce the number of outgoing queries. * Provide more information when memory allocation fails. Bug Fixes: * Make DNSSEC key rollovers more robust. * Fix a catalog zone issue, where member zones could fail to load. * Allow glue in delegations with QTYPE=ANY. * Fix slow speed when signing a large delegation zone with NSEC3 opt-out. * Reconfiguring an NSEC3 opt-o
This update for bind fixes the following issues: - CVE-2025-40778: Address various spoofing attacks (bsc#1252379). - CVE-2025-40780: Cache-poisoning due to weak pseudo-random number generator (bsc#1252380).
This update for bind fixes the following issues: Upgrade to release 9.20.15: - CVE-2025-8677: DNSSEC validation fails if matching but invalid DNSKEY is found (bsc#1252378). - CVE-2025-40778: Address various spoofing attacks (bsc#1252379). - CVE-2025-40780: Cache-poisoning due to weak pseudo-random number generator (bsc#1252380).
This update for bind fixes the following issues: - Upgrade to release 9.20.11 - CVE-2025-40777: Fixed a possible assertion failure when stale-answer-client-timeout is set to 0. (bsc#1246548)
This update for bind fixes the following issues: Update to version 9.20.9. - Security issues fixed: * CVE-2025-40775: denial-of-service due to assertion failure caused by the processing of a NS message with an invalid TSIG (bsc#1243361). * CVE-2024-12705: CPU and memory exhaustion due to DNS-over-HTTPS issues that arise under heavy query load (bsc#1236597). * CVE-2024-11187: CPU exhaustion when processing queries that lead to responses containing several records in the Additional data section (bsc#1236596). - Changelog: - Feature changes: * Performance optimization for NSEC3 lookups introduced in BIND 9.20.2
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.