This update for bind fixes the following issues:
- CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
- CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
- CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
- CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
- CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
- CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildc
This update for bind fixes the following issues
- CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
- CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
- CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
- CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
- CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
- CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).
This update for bind fixes the following issues:
- CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
- CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
- CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
This update for bind fixes the following issues:
- CVE-2026-1519: high CPU load during insecure delegation validation due to excessive NSEC3 iterations (bsc#1260805).
This update for bind fixes the following issues:
- CVE-2025-40778: Address various spoofing attacks (bsc#1252379).
- CVE-2025-40780: Cache-poisoning due to weak pseudo-random number generator (bsc#1252380).
This update for bind fixes the following issues:
Update to 9.16.50:
- Bug Fixes:
* A regression in cache-cleaning code enabled memory use to grow
significantly more quickly than before, until the configured
max-cache-size limit was reached. This has been fixed.
* Using rndc flush inadvertently caused cache cleaning to become
less effective. This could ultimately lead to the configured
max-cache-size limit being exceeded and has now been fixed.
* The logic for cleaning up expired cached DNS records was
tweaked to be more aggressive. This change helps with enforcing
max-cache-ttl and max-ncache-ttl in a timely ma