Critical Security Flaw in BIND Package: Important Bind Security Update
Summary
ALSA-2026:54510: Important: bind security update. Affects bind versions < 32:9.16.23-40.el9_8.8. Fixed in 32:9.16.23-40.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for application interfacing, and various tools for DNS server verification. BIND is essential for translating human-readable domain names into IP addresses, making it a cornerstone of internet functionality. However, vulnerabilities in BIND can lead to severe security risks, including DNS spoofing and service disruptions.
Vulnerability Detail
This vulnerability arises from multiple security flaws within BIND, including a potential wildcard CNAME RPZ policy bypass (CVE-2026-11331), DNSSEC validation bypass via out-of-zone NSEC next field (CVE-2026-13321), and cache poisoning due to label count discrepancies (CVE-2026-11721). These vulnerabilities can lead to unauthorized access, data manipulation, and denial of service, posing significant risks to network integrity and security.
How To Fix
Minimum fixed version
32:9.16.23-40.el9_8.8
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their DNS servers by implementing strict access controls and monitoring DNS queries. However, this is not a substitute for applying the security update.
Conclusion
The BIND package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain network security and integrity. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for bind →
FAQ
BIND stands for Berkeley Internet Name Domain and is a software suite that implements the DNS protocols for the internet.
The vulnerabilities can lead to unauthorized access, data manipulation, and denial of service attacks, compromising network security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Implement strict access controls and monitor DNS queries as a temporary workaround until the update can be applied.
Detailed information about the vulnerabilities can be found on the respective CVE pages listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
