Critical Security Flaw in BIND Package: Important Update Required
Summary
RLSA-2026:55437: Important: bind security update. Affects bind versions < 2:9.18.33-15.el10_2.10. Fixed in 2:9.18.33-15.el10_2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for application interfacing, and tools for verifying DNS server operations. BIND is crucial for translating domain names into IP addresses, making it a foundational component of internet infrastructure. However, it is susceptible to various security vulnerabilities that can compromise DNS integrity and availability.
Vulnerability Detail
This vulnerability arises from multiple security flaws in BIND, including a potential wildcard CNAME RPZ policy bypass, DNSSEC validation bypass, memory usage beyond configured limits, cache poisoning, unexpected exits with NSEC and NSEC3 records, and incorrect acceptance of NSEC3 records. These issues can lead to severe ramifications, such as unauthorized access to DNS records, service disruptions, and data integrity breaches. The vulnerabilities are cataloged under CVEs, with a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
2:9.18.33-15.el10_2.10
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling specific features of BIND that are known to be vulnerable until the package can be updated. However, this is not a long-term solution and should only be used if absolutely necessary.
Conclusion
In summary, the identified vulnerabilities in the BIND package pose significant risks to DNS integrity and availability. It is crucial to update to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for bind →
FAQ
BIND stands for Berkeley Internet Name Domain and is a software that implements the DNS protocols, allowing for domain name resolution.
Failing to update BIND can lead to security breaches, unauthorized access to DNS records, and potential service disruptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
For support, you can reach out to your system administrator or consult the official BIND documentation and community forums.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
