Critical Security Update for BIND Package: Denial of Service Vulnerability
Summary
ALSA-2026:8075: Important: bind security update. Affects bind versions < 32:9.16.23-34.el9_7.2. Fixed in 32:9.16.23-34.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for translating human-readable domain names into IP addresses, making it a critical component of internet infrastructure. However, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-1519 allows for a Denial of Service (DoS) attack through maliciously crafted DNSSEC-validated zones. An attacker can exploit this vulnerability to disrupt the normal operation of the DNS server, potentially leading to service outages and affecting all dependent services relying on DNS resolution. This issue arises from improper handling of DNSSEC validation, which can be triggered by specially crafted DNS responses.
How To Fix
Minimum fixed version
32:9.16.23-34.el9_7.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable DNSSEC validation in your BIND configuration. However, this is not recommended as a long-term solution since it may expose your DNS server to other vulnerabilities. To disable DNSSEC, you can modify the named.conf file and set 'dnssec-validation no;'. Remember to revert this change once the update is applied.
Conclusion
The BIND package has a critical vulnerability (CVE-2026-1519) that can lead to Denial of Service attacks. It is crucial to update to the patched version to ensure the security and reliability of your DNS services. Utilize tools like Vulert to monitor and assess your applications for vulnerabilities effectively.
See every vulnerability recorded for bind →
FAQ
CVE-2026-1519 is a vulnerability in the BIND package that allows for Denial of Service attacks through malicious DNSSEC-validated zones.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to service outages, affecting all services that rely on the DNS server for name resolution.
Yes, the patched version of the BIND package is 32:9.16.23-34.el9_7.2. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider disabling DNSSEC validation as a temporary workaround, but be aware of the associated risks.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
