Critical Security Update for bind9.18: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:55442: Important: bind9.18 security update. Affects bind9.18 versions < 2:9.18.29-14.el9_8.8. Fixed in 2:9.18.29-14.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for application interfacing with DNS, and various tools for DNS server verification. The package bind9.18 is a specific version that has been identified with several security vulnerabilities that could potentially compromise DNS operations.
Vulnerability Detail
The vulnerabilities in bind9.18 stem from various issues, including a potential wildcard CNAME RPZ policy bypass (CVE-2026-11331), DNSSEC validation bypass via out-of-zone NSEC next field (CVE-2026-13321), and memory usage beyond configured limits (CVE-2026-11622). These vulnerabilities could lead to cache poisoning, unexpected exits, and incorrect acceptance of NSEC3 records, posing significant risks to DNS integrity and reliability.
How To Fix
Minimum fixed version
2:9.18.29-14.el9_8.8
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of DNSSEC features or disable specific configurations that may expose your system to these vulnerabilities. However, this is not a long-term solution and should only be considered until the package can be updated.
Conclusion
The bind9.18 package has several critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain the security and integrity of DNS operations. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bind9.18 →
FAQ
The CVSS score of the vulnerabilities is 8.6, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The main vulnerabilities include potential CNAME policy bypass, DNSSEC validation bypass, memory usage issues, cache poisoning, and incorrect acceptance of NSEC3 records.
Yes, you should update to version 2:9.18.29-14.el9_8.8 or later to ensure all vulnerabilities are patched.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
