Critical Denial of Service Vulnerability in BIND Package
Summary
ALSA-2026:8352: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.7. Fixed in 32:9.11.36-16.el8_10.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying the DNS server's operation. BIND is critical for the functioning of the internet, as it translates human-readable domain names into IP addresses. However, it is susceptible to security vulnerabilities that can compromise its integrity and availability.
Vulnerability Detail
This vulnerability, identified as CVE-2026-1519, allows for a Denial of Service (DoS) attack through maliciously crafted DNSSEC-validated zones. An attacker can exploit this flaw to disrupt the normal operation of the DNS server, leading to potential service outages and loss of availability for users relying on the affected DNS services. The vulnerability arises from improper handling of DNSSEC validation, which can be triggered by specially crafted DNS responses.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.7
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable DNSSEC validation in your BIND configuration. However, this is not recommended as it may expose your DNS server to other security risks. The configuration can be modified in the named.conf file by setting 'dnssec-validation no;'.
Conclusion
The BIND package is critical for DNS functionality, but it is vulnerable to a Denial of Service attack as outlined in CVE-2026-1519. It is crucial to update to the patched version to mitigate risks. Utilize tools like Vulert to monitor vulnerabilities in your applications effectively.
See every vulnerability recorded for bind →
FAQ
The impact includes potential Denial of Service attacks that can disrupt DNS services, affecting users' ability to resolve domain names.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing the temporary workaround by disabling DNSSEC validation, but be aware of the associated risks.
Yes, BIND has a history of vulnerabilities. Regularly check for updates and security advisories to stay informed.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into your application's security.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
