Critical Security Update for BIND 9.16: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:54509: Important: bind9.16 security update. Affects bind9.16 versions < 32:9.16.23-0.22.el8_10.12. Fixed in 32:9.16.23-0.22.el8_10.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and tools for verifying the DNS server's operation. BIND is essential for translating human-friendly domain names into IP addresses, making it a critical component of internet infrastructure. The recent vulnerabilities identified in BIND 9.16 could potentially compromise its functionality and security.
Vulnerability Detail
The vulnerabilities in BIND 9.16 include a potential wildcard CNAME RPZ policy bypass, DNSSEC validation bypass via out-of-zone NSEC next field, potential memory usage beyond configured limits, cache poisoning via label count discrepancy, unexpected exit with NSEC and NSEC3 both present, and incorrect acceptance of NSEC3 records. These vulnerabilities could lead to unauthorized access, data corruption, or service disruption, posing significant risks to systems relying on BIND for DNS services.
How To Fix
Minimum fixed version
32:9.16.23-0.22.el8_10.12
This is the first release that contains the fix.
sudo dnf update bind9.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict access controls and monitoring DNS queries to detect any unusual activity. Additionally, disabling features that are not in use may help mitigate some risks until the update can be applied.
Conclusion
The recent security update for BIND 9.16 addresses multiple critical vulnerabilities that could severely impact DNS functionality and security. It is crucial for users to update their systems promptly to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for bind9.16 →
FAQ
BIND (Berkeley Internet Name Domain) is a software suite that provides an implementation of the DNS protocols, allowing for the resolution of domain names to IP addresses.
The vulnerabilities could lead to unauthorized access, data corruption, service disruptions, and potential exploitation by malicious actors.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Implement strict access controls, monitor DNS queries for unusual activity, and disable unused features as temporary measures until you can apply the update.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.16.
