Critical Security Update for BIND Package: Denial of Service Vulnerabilities
Summary
ALSA-2026:75767: Important: bind security update. Affects bind versions < 32:9.16.23-40.el9_8.10. Fixed in 32:9.16.23-40.el9_8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for DNS server verification. BIND is crucial for translating human-readable domain names into IP addresses, making it an essential component of internet infrastructure. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, impacting the availability of services relying on DNS.
Vulnerability Detail
The vulnerabilities in BIND are primarily related to Denial of Service (DoS) attacks that can be triggered by specific malformed DNS responses. The issues stem from improper handling of DNS negative cache length truncation (CVE-2026-19667), crafted DNSSEC replies (CVE-2026-80274), and malformed DNS64 responses (CVE-2026-19666). These vulnerabilities can allow an attacker to crash the DNS server or disrupt its normal operations, leading to service outages and potential data loss.
How To Fix
Minimum fixed version
32:9.16.23-40.el9_8.10
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the DNS server or implement rate limiting to mitigate the risk of exploitation until the package is updated. Additionally, consider using firewall rules to restrict incoming traffic to the DNS server.
Conclusion
The identified vulnerabilities in the BIND package pose significant risks, including potential Denial of Service attacks. It is crucial to update to the latest patched version to safeguard your systems. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time, ensuring your applications remain secure.
See every vulnerability recorded for bind →
FAQ
BIND is a software suite that implements the Domain Name System (DNS) protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities can lead to Denial of Service attacks, causing the DNS server to crash or become unresponsive, which can disrupt services relying on DNS.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, you can implement rate limiting and restrict access to the DNS server using firewall rules as a temporary workaround.
It is recommended to regularly check for updates and apply security patches as soon as they are released to minimize the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
