Critical Security Update for BIND Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:55437: Important: bind security update. Affects bind versions < 32:9.18.33-15.el10_2.10. Fixed in 32:9.18.33-15.el10_2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for translating human-readable domain names into IP addresses, making it a critical component of internet infrastructure. However, recent vulnerabilities have been identified that could compromise its security and functionality.
Vulnerability Detail
The vulnerabilities in BIND include a potential wildcard CNAME RPZ policy bypass (CVE-2026-11331), DNSSEC validation bypass via out-of-zone NSEC next field (CVE-2026-13321), potential memory usage beyond configured limits (CVE-2026-11622), cache poisoning via label count discrepancy (CVE-2026-11721), unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204), and incorrect acceptance of NSEC3 records (CVE-2026-10723). These vulnerabilities could lead to unauthorized access, data corruption, or service disruption, posing significant risks to systems relying on BIND for DNS services.
How To Fix
Minimum fixed version
32:9.18.33-15.el10_2.10
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing strict access controls and monitoring DNS traffic for unusual patterns to mitigate risks until the update can be applied.
Conclusion
The recent vulnerabilities identified in the BIND package pose significant risks to DNS services. It is crucial for users to update to the patched version to mitigate these risks effectively. Regular monitoring and adherence to security best practices are essential for maintaining the integrity of DNS operations.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities could lead to unauthorized access, data corruption, or service disruption, affecting the reliability of DNS services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement strict access controls and monitor DNS traffic for unusual patterns as a temporary measure until you can apply the update.
For detailed information, refer to the CVE pages listed in the related section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
