Critical Security Update for BIND Package: Important Vulnerabilities Addressed
Summary
ALSA-2026:54654: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.14. Fixed in 32:9.11.36-16.el8_10.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying the DNS server's operation. BIND is critical for the functioning of internet services, making its security paramount. The recent vulnerabilities identified could lead to severe security risks, including DNSSEC validation bypass and cache poisoning.
Vulnerability Detail
The vulnerabilities in BIND include a DNSSEC validation bypass via an out-of-zone NSEC next field (CVE-2026-13321), potential memory usage beyond configured limits (CVE-2026-11622), cache poisoning due to label count discrepancies and wildcards (CVE-2026-11721), unexpected exits when both NSEC and NSEC3 are present (CVE-2026-13204), and incorrect acceptance of NSEC3 records (CVE-2026-10723). These vulnerabilities can lead to unauthorized access, data corruption, and service disruptions.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.14
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling DNSSEC validation if it is not critical for your operations. However, this is not a recommended long-term solution and should only be used until the patch is applied.
Conclusion
The recent vulnerabilities in the BIND package pose serious security risks that require immediate attention. Updating to the latest patched version is crucial to safeguard your systems against potential exploits. Utilize tools like Vulert to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols that provides a DNS server and resolver library, essential for internet functionality.
The vulnerabilities can lead to DNSSEC validation bypass, cache poisoning, and unexpected service interruptions, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling DNSSEC validation as a temporary workaround until the patch can be applied.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
