Critical Security Update for BIND 9.16: Denial of Service Vulnerability
Summary
ALSA-2026:8155: Important: bind9.16 security update. Affects bind9.16 versions < 32:9.16.23-0.22.el8_10.5. Fixed in 32:9.16.23-0.22.el8_10.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is crucial for internet functionality, managing domain name resolution and ensuring reliable network communication. However, it is susceptible to security vulnerabilities that can compromise its operation and the services it provides.
Vulnerability Detail
The vulnerability identified as CVE-2026-1519 allows for a Denial of Service (DoS) attack through maliciously crafted DNSSEC-validated zones. An attacker can exploit this vulnerability to disrupt the availability of the DNS service, potentially leading to significant downtime and loss of access to critical services relying on DNS resolution. The issue arises from improper handling of certain DNSSEC responses, which can cause the BIND server to crash or become unresponsive.
How To Fix
Minimum fixed version
32:9.16.23-0.22.el8_10.5
This is the first release that contains the fix.
sudo dnf update bind9.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling DNSSEC validation if it is not critical for your operations. However, this is not recommended as it may expose your DNS queries to spoofing attacks. It is best to apply the security update as soon as possible.
Conclusion
The BIND 9.16 security update addresses a critical vulnerability that could lead to Denial of Service attacks. It is imperative to update to the patched version to ensure the security and reliability of your DNS services. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software environment.
See every vulnerability recorded for bind9.16 →
FAQ
CVE-2026-1519 is a vulnerability in BIND 9.16 that allows for Denial of Service attacks through maliciously crafted DNSSEC-validated zones.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Failing to address this vulnerability may lead to service disruptions, making your DNS server unresponsive and affecting all services relying on it.
While the best course of action is to update, you may temporarily disable DNSSEC validation as a workaround, though this is not recommended.
If you experience problems after updating, consult the BIND documentation or seek support from the community for troubleshooting assistance.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.16.
