Critical Denial of Service Vulnerabilities in BIND Package
Summary
RLSA-2026:79162: Important: bind security update. Affects bind versions < 2:9.11.36-16.el8_10.16. Fixed in 2:9.11.36-16.el8_10.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for DNS server verification. BIND is essential for translating domain names into IP addresses, making it a critical component of internet infrastructure. However, its complexity also makes it susceptible to various security vulnerabilities.
Vulnerability Detail
This vulnerability affects BIND 9 and is characterized by multiple Denial of Service (DoS) issues. The vulnerabilities arise from improper handling of DNS negative cache, crafted DNSSEC replies, and malformed DNS64 responses. These issues can lead to service disruptions, making the DNS server unresponsive and affecting all applications relying on it. The vulnerabilities are tracked under CVE-2026-19666, CVE-2026-19667, and CVE-2026-80274, with a CVSS score of 7.5 indicating a high severity level.
How To Fix
Minimum fixed version
2:9.11.36-16.el8_10.16
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the DNS server or implement firewall rules to restrict incoming traffic until the package is updated. This can help mitigate the risk of exploitation while awaiting the patch.
Conclusion
The vulnerabilities in the BIND package present significant risks that can lead to service disruptions. It is crucial for users to update their installations to the latest patched version to mitigate these risks. Regular monitoring and updates are essential for maintaining the security of DNS services.
See every vulnerability recorded for bind →
FAQ
BIND stands for Berkeley Internet Name Domain and is a software that implements the DNS protocols, allowing domain names to be translated into IP addresses.
The vulnerabilities can lead to Denial of Service attacks, causing the DNS server to become unresponsive and disrupting services that rely on DNS resolution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires immediate attention.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
