Critical Security Update for BIND 9.18: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:55442: Important: bind9.18 security update. Affects bind9.18 versions < 32:9.18.29-14.el9_8.8. Fixed in 32:9.18.29-14.el9_8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS (Domain Name System) software that provides essential services for resolving hostnames to IP addresses. It includes a DNS server (named), a resolver library for application interfacing, and various tools for DNS server verification. The recent vulnerabilities identified in BIND 9.18 could potentially compromise DNS operations, leading to security risks for systems relying on this software.
Vulnerability Detail
The vulnerabilities in BIND 9.18 include a potential wildcard CNAME RPZ policy bypass, DNSSEC validation bypass via out-of-zone NSEC next field, memory usage beyond configured limits, cache poisoning via label count discrepancies, unexpected exits with NSEC and NSEC3 records, and incorrect acceptance of NSEC3 records. These issues could lead to unauthorized access, data corruption, or denial of service, posing significant risks to network security.
How To Fix
Minimum fixed version
32:9.18.29-14.el9_8.8
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict access controls on your DNS servers and monitoring DNS traffic for unusual patterns. Additionally, disabling features that are not in use may help mitigate some risks until the update can be applied.
Conclusion
The vulnerabilities in BIND 9.18 present critical security risks that must be addressed promptly. Updating to the latest patched version is essential to maintain the integrity and security of DNS operations. Users are encouraged to monitor their systems and apply the necessary updates as soon as possible.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is an implementation of the DNS protocols, providing services for hostname resolution and DNS server management.
The vulnerabilities could lead to unauthorized access, data corruption, or denial of service, impacting the security and reliability of DNS services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring a signup.
Implement strict access controls and monitor DNS traffic for unusual patterns as a temporary measure until you can apply the update.
For detailed information, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
