Critical Security Update for BIND 9.18: Denial of Service Vulnerability
Summary
ALSA-2026:7915: Important: bind9.18 security update. Affects bind9.18 versions < 32:9.18.29-5.el9_7.4. Fixed in 32:9.18.29-5.el9_7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for application interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for the functioning of the internet, providing critical services for domain resolution and management.
Vulnerability Detail
The vulnerability identified as CVE-2026-1519 in BIND 9.18 allows for a Denial of Service (DoS) attack via maliciously crafted DNSSEC-validated zones. This means that an attacker could exploit this vulnerability to disrupt the normal operation of the DNS server, potentially leading to service outages and affecting users' ability to access websites and services.
How To Fix
Minimum fixed version
32:9.18.29-5.el9_7.4
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable DNSSEC validation for the affected zones until the update can be applied. This can be done by modifying the BIND configuration file (named.conf) to include the following directive: 'dnssec-validation no;'. However, this is not a permanent solution and should only be used until the patch is applied.
Conclusion
The BIND 9.18 vulnerability CVE-2026-1519 poses a significant risk of Denial of Service attacks. It is crucial to update to the patched version to ensure the security and reliability of your DNS services. Implementing the recommended fixes and workarounds will help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is an implementation of the DNS protocols that provides a DNS server, resolver library, and tools for DNS management.
CVE-2026-1519 refers to a specific vulnerability in BIND 9.18 that allows for Denial of Service attacks through malicious DNSSEC-validated zones.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Failing to address this vulnerability could lead to service outages, making it difficult for users to access websites and services that rely on the affected DNS server.
Yes, you can temporarily disable DNSSEC validation for affected zones in your BIND configuration as a workaround until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
