Ubuntu notice Ubuntu 10h ago

Bind vulnerabilities

CVE-2026-75029 CVE-2026-19662 CVE-2026-19668+15 more Canonical Operating system

It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029) It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19662) It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could possibly use this issue to cause Bind to use exces

Read at Ubuntu Security Notices

Vendor: Canonical
Product: Ubuntu
EPSS: 0.005 (p41)
Exposure class: Operating system

Why it ranks 46 (High)

Product class: operating system
Widely deployed vendor product (Canonical)
Covered by 3 independent sources
Vendor security advisory
Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.

Related coverage

Other items that share a CVE or were clustered with this one.

Bind vulnerabilities

Links

Related coverage

ISC BIND security advisory (AV26-1072)

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion…

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing…

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`".

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.

21st September – Threat Intelligence Report

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed…

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged…

If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an…

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record).

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record.

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named`…

For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with…

Keyboard