SB2026081348 - Red Hat Enterprise Linux 9 update for bind
Published: August 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-11331)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass RPZ rules.
The vulnerability exists due to improper error handling in RPZ processing when processing sufficiently long query names that trigger a NAMETOOLONG condition with wildcard CNAME policies. A remote attacker can send a crafted query name to bypass RPZ rules.
The issue only affects resolvers that use RPZ with wildcard CNAME policies.
2) Input validation error (CVE-ID: CVE-2026-13321)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause authenticated denial-of-service responses.
The vulnerability exists due to improper input validation in DNSSEC NSEC record validation when processing validly signed NSEC records whose next domain name points outside the signer's zone. A remote attacker can craft malicious NSEC records to poison the DNS cache and cause authenticated denial-of-service responses.
Exploitation requires control of any DNSSEC-signed zone.
3) Resource exhaustion (CVE-ID: CVE-2026-11622)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the DNSSEC validating resolver when processing queries during a random subdomain attack against a DNSSEC-signed zone. A remote attacker can send queries faster than the resolver can perform validation to cause a denial of service.
Only DNSSEC validating resolvers targeted with a random subdomain attack against a DNSSEC-signed zone are affected.
4) Input validation error (CVE-ID: CVE-2026-11721)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to improper input validation in named when processing DNS responses containing an RRSIG with fewer labels than the containing zone and wildcard records. A remote attacker can operate an authoritative zone that returns a specially crafted response to poison the DNS cache.
The issue has effect only when the resolver under attack has synth-from-dnssec yes; enabled, which is the default.
5) Reachable assertion (CVE-ID: CVE-2026-13204)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion failure in the DNSSEC validation logic when validating a provably insecure domain covered by both an NSEC and NSEC3 record at the parent with an RRSIG for only one of these types. A remote attacker can provide crafted DNS data to cause a denial of service.
6) Input validation error (CVE-ID: CVE-2026-10723)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge authenticated NXDOMAIN responses.
The vulnerability exists due to improper validation of child-zone NSEC3 records in BIND 9 when processing DNSSEC records. A remote attacker can provide incorrect child-zone NSEC3 records to forge authenticated NXDOMAIN responses.
The issue can affect sibling zones.
Remediation
Install update from vendor's website.