Critical Denial of Service Vulnerability in BIND Package: Important Security Update
Summary
ALSA-2026:79162: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.16. Fixed in 32:9.11.36-16.el8_10.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols, which includes a DNS server (named), a resolver library for applications, and tools for verifying DNS server operations. BIND is essential for translating domain names into IP addresses, making it a critical component of internet functionality. However, vulnerabilities in BIND can lead to severe security risks, including denial of service attacks.
Vulnerability Detail
The vulnerability stems from multiple issues in BIND 9, including a denial of service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667), crafted DNSSEC replies (CVE-2026-80274), and malformed DNS64 responses (CVE-2026-19666). These vulnerabilities can be exploited by attackers to disrupt DNS services, potentially leading to significant downtime and loss of availability for affected systems.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.16
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on DNS queries or using a firewall to block suspicious traffic until the package can be updated. However, these are not permanent solutions and should not replace the need for an update.
Conclusion
The BIND package has critical vulnerabilities that can lead to denial of service attacks. It is crucial to update to the patched version to ensure the security and availability of DNS services. Temporary workarounds can be implemented, but they should not replace the need for a proper update.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols that provides a DNS server and resolver library, essential for domain name resolution.
Attackers can exploit this vulnerability to launch denial of service attacks, causing disruptions in DNS services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing temporary workarounds such as rate limiting or firewall rules to mitigate the risk.
More details can be found on the CVE pages for CVE-2026-19666, CVE-2026-19667, and CVE-2026-80274.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
