Critical Security Update for BIND Package: Remote Denial of Service Vulnerability
Summary
ALSA-2026:75577: Important: bind security update. Affects bind versions < 32:9.18.33-15.el10_2.12. Fixed in 32:9.18.33-15.el10_2.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for translating domain names into IP addresses, making it a critical component of internet infrastructure. However, recent vulnerabilities have been identified that could allow attackers to exploit BIND, leading to potential service disruptions.
Vulnerability Detail
The vulnerabilities in BIND include several denial of service (DoS) issues that can be triggered by malformed DNS requests or responses. Specifically, attackers can exploit cached SVCB/HTTPS AliasMode records (CVE-2026-81736), cause resource exhaustion in SVCB/HTTPS processing (CVE-2026-81563), and manipulate DNSSEC replies (CVE-2026-80274). These vulnerabilities can lead to service outages, affecting the availability of DNS services and potentially disrupting internet connectivity for users relying on affected servers.
How To Fix
Minimum fixed version
32:9.18.33-15.el10_2.12
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk of these vulnerabilities by implementing rate limiting on DNS requests and monitoring for unusual traffic patterns. Additionally, consider disabling features that are not in use, such as DNSSEC, until the update can be applied.
Conclusion
The recent vulnerabilities in the BIND package pose significant risks to DNS services, potentially leading to denial of service attacks. It is crucial for users to update to the patched version to ensure the security and availability of their DNS infrastructure. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the Domain Name System (DNS) protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities can lead to denial of service attacks, causing disruptions in DNS services and affecting internet connectivity.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check for vulnerabilities without needing to sign up.
Yes, a patched version of BIND (32:9.18.33-15.el10_2.12) is available. It is crucial to update to this version to mitigate the vulnerabilities.
If immediate updates are not possible, implement rate limiting on DNS requests and monitor traffic for unusual patterns as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
