SB2026103122 - Ubuntu update for bind9
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-19666)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in query_addnoqnameproof() via the DNS64 filter64 path when processing a malformed applicable answer from an authoritative server. A remote attacker can send a malformed applicable DNS answer to cause a denial of service.
Only resolvers configured to use dns64 are affected.
2) Resource exhaustion (CVE-ID: CVE-2026-81736)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient resource consumption in the BIND resolver when querying the root of a cached tree of SVCB/HTTPS AliasMode records. A remote attacker can send a query for the root of the cached record tree to cause a denial of service.
3) Memory leak (CVE-ID: CVE-2026-81563)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a failure to properly deallocate internal resources in SVCB/HTTPS AliasMode additional-data processing when processing an SVCB/HTTPS AliasMode record that references 14 or more SVCB/HTTPS ServiceMode records. A remote attacker can cause the resolver to process such records to cause a denial of service.
Repeated exploitation is required to exhaust resources.
4) Input validation error (CVE-ID: CVE-2026-80274)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of a NOQNAME proof in the BIND validating resolver when processing DNSSEC responses. A remote attacker can send a DNS response containing a valid wildcard answer and signed NSEC3 proof followed by an unsigned NSEC record at the same owner name to cause a denial of service.
The resolver must query a DNSSEC-signed authoritative zone.
5) Input validation error (CVE-ID: CVE-2026-78301)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause BIND to return attacker-supplied DNS data.
The vulnerability exists due to improper input validation in the named zone database when loading a malformed zone containing an NS or DNAME node above its origin. A remote privileged user can insert a malformed zone to cause BIND to return attacker-supplied DNS data.
On servers that also provide recursion, BIND can follow the locally sourced zone cut and cache attacker-supplied records for names outside the configured zone. On purely authoritative servers, queries may return out-of-zone referrals without the AA flag.
6) Input validation error (CVE-ID: CVE-2026-77692)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of cryptographically invalid SIG(0) records in named when processing crafted DNS-over-HTTPS requests. A remote attacker can send a crafted DNS-over-HTTPS request containing a cryptographically invalid SIG(0) record and prematurely close the transport connection to cause a denial of service.
7) Insufficient verification of data authenticity (CVE-ID: CVE-2026-77119)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DNS cache poisoning.
The vulnerability exists due to insufficient verification of data authenticity in BIND 9 NSEC3 insecure-referral proof validation when processing insecure-referral proofs. A remote attacker can provide a validly signed NSEC3 record from an unrelated sibling zone to cause DNS cache poisoning.
8) Reachable assertion (CVE-ID: CVE-2026-76163)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a reachable assertion in BIND named TKEY query handling when processing a TKEY query. A remote attacker can send a TKEY query to cause a denial of service.
The issue occurs when the named.conf configuration file contains no global options block.
9) Resource exhaustion (CVE-ID: CVE-2026-75029)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of duplicate singleton RDATA records in the named message parser when processing query responses. A remote attacker can send a query response containing multiple identical copies of a record that should exist only once to cause a denial of service.
10) Insufficient verification of data authenticity (CVE-ID: CVE-2026-19941)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to insufficient verification of data authenticity in the checkwildcard() function of the named resolver when validating wildcard-nonexistence proofs. A remote attacker can provide an out-of-zone NSEC record as proof that a wildcard does not exist to poison the DNS cache.
Exploitation requires control at the same or an upstream level of the zone name.
11) Resource exhaustion (CVE-ID: CVE-2026-19668)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the BIND recursive resolver when processing large numbers of invalid DNSSEC records. A remote attacker can cause the resolver to process excessive invalid DNSSEC cryptographic material to cause a denial of service.
12) Numeric Truncation Error (CVE-ID: CVE-2026-19667)
CWE-ID: CWE-197 - Numeric Truncation Error
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to numeric truncation in dns_ncache_add() when processing a negative answer exactly 65536 bytes long from an attacker-controlled authoritative server. A remote attacker can return such a negative answer to cause a denial of service.
13) Insufficient verification of data authenticity (CVE-ID: CVE-2025-40778)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]
The vulnerability allows a remote attacker to poison DNS cache.
The vulnerability exists due to insufficient verification of data authenticity when accepting records from answers. A remote attacker can inject forged data into the cache leading to DNS cache poisoning.
14) Use-after-free (CVE-ID: CVE-2026-19662)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in qpcache NOQNAME proof handling when processing crafted DNSSEC responses from an attacker-controlled authoritative server. A remote attacker can send a particular sequence of crafted DNS answers to cause a denial of service.
Exploitation requires inducing the resolver to issue multiple queries for a DNSSEC-signed zone and relies on the responses arriving in a particular order and with particular timing.
15) Insufficient verification of data authenticity (CVE-ID: CVE-2026-19033)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to add arbitrary data to a zone.
The vulnerability exists due to improper verification of TSIG signatures in named IXFR processing when processing a multi-message TCP IXFR for a TSIG-restricted secondary zone. A remote attacker can send an IXFR transfer without a valid TSIG signature to add arbitrary data to a zone.
16) Resource exhaustion (CVE-ID: CVE-2026-1519)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the DNSSEC validation component when handling NSEC3 records during insecure delegation validation. A remote attacker can send a specially crafted DNS zone response to cause excessive CPU load on the resolver.
Resolvers performing DNSSEC validation are affected; authoritative-only servers are generally not affected unless they perform recursive queries.
17) Input validation error (CVE-ID: CVE-2026-13321)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache and cause authenticated denial-of-service responses.
The vulnerability exists due to improper input validation in DNSSEC NSEC record validation when processing validly signed NSEC records whose next domain name points outside the signer's zone. A remote attacker can craft malicious NSEC records to poison the DNS cache and cause authenticated denial-of-service responses.
Exploitation requires control of any DNSSEC-signed zone.
18) Reachable assertion (CVE-ID: CVE-2026-13204)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion failure in the DNSSEC validation logic when validating a provably insecure domain covered by both an NSEC and NSEC3 record at the parent with an RRSIG for only one of these types. A remote attacker can provide crafted DNS data to cause a denial of service.
19) Input validation error (CVE-ID: CVE-2026-11721)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to improper input validation in named when processing DNS responses containing an RRSIG with fewer labels than the containing zone and wildcard records. A remote attacker can operate an authoritative zone that returns a specially crafted response to poison the DNS cache.
The issue has effect only when the resolver under attack has synth-from-dnssec yes; enabled, which is the default.
20) Resource exhaustion (CVE-ID: CVE-2026-11622)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the DNSSEC validating resolver when processing queries during a random subdomain attack against a DNSSEC-signed zone. A remote attacker can send queries faster than the resolver can perform validation to cause a denial of service.
Only DNSSEC validating resolvers targeted with a random subdomain attack against a DNSSEC-signed zone are affected.
21) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-11331)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass RPZ rules.
The vulnerability exists due to improper error handling in RPZ processing when processing sufficiently long query names that trigger a NAMETOOLONG condition with wildcard CNAME policies. A remote attacker can send a crafted query name to bypass RPZ rules.
The issue only affects resolvers that use RPZ with wildcard CNAME policies.
22) Input validation error (CVE-ID: CVE-2026-10822)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in DNS record text rendering when processing a stored DNS record with a PRIVATEDNS algorithm identifier length longer than the actual identifier data. A remote attacker can supply a specially crafted DNS record to cause a denial of service.
User interaction is required for BIND to later render the stored record to text.
23) Input validation error (CVE-ID: CVE-2026-10723)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge authenticated NXDOMAIN responses.
The vulnerability exists due to improper validation of child-zone NSEC3 records in BIND 9 when processing DNSSEC records. A remote attacker can provide incorrect child-zone NSEC3 records to forge authenticated NXDOMAIN responses.
The issue can affect sibling zones.
24) Resource exhaustion (CVE-ID: CVE-2025-8677)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when querying for data within a specially crafted zone containing certain malformed DNSKEY records. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.