Bugs fixes in "bind9"
| Origin | Bug number | Title | Date fixed |
|---|---|---|---|
| CVE | CVE-2026-80274 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed | 2026-10-14 |
| CVE | CVE-2026-77119 | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged un | 2026-10-14 |
| CVE | CVE-2026-81563 | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate int | 2026-10-14 |
| CVE | CVE-2026-78301 | A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a | 2026-10-14 |
| CVE | CVE-2026-77692 | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing t | 2026-10-14 |
| CVE | CVE-2026-19941 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an u | 2026-10-14 |
| CVE | CVE-2026-19033 | For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with | 2026-10-14 |
| CVE | CVE-2026-76163 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an | 2026-10-14 |
| CVE | CVE-2026-19666 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` | 2026-10-14 |
| CVE | CVE-2026-19668 | A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. | 2026-10-14 |
| CVE | CVE-2026-19662 | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC- | 2026-10-14 |
| CVE | CVE-2026-75029 | In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is th | 2026-10-14 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
| CVE | CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B | 2026-09-01 |
About
-
Send Feedback to @ubuntu_updates
