Critical Remote Denial of Service Vulnerability in BIND 9.18
Summary
RLSA-2026:75578: Important: bind9.18 security update. Affects bind9.18 versions < 2:9.18.29-14.el9_8.10. Fixed in 2:9.18.29-14.el9_8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for applications interfacing with DNS, and various tools for DNS server verification. BIND 9.18 is a specific version that has been identified to contain multiple vulnerabilities that could lead to denial of service attacks.
Vulnerability Detail
The vulnerabilities in BIND 9.18 stem from improper handling of DNS records, which can be exploited to cause remote denial of service. Specifically, the issues include resource exhaustion from SVCB/HTTPS AliasMode processing, denial of service via crafted DNSSEC replies, and malformed DNS64 responses. These vulnerabilities can be triggered by sending specially crafted DNS requests, leading to service interruptions and potential downtime for affected systems.
How To Fix
Minimum fixed version
2:9.18.29-14.el9_8.10
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the DNS server by configuring firewall rules to restrict incoming requests from untrusted sources. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerabilities identified in BIND 9.18 pose significant risks of remote denial of service attacks. It is crucial to update to the patched version to ensure the security and stability of your DNS services. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is a software suite that implements the DNS protocols for the Internet, allowing for the resolution of hostnames to IP addresses.
The vulnerabilities can lead to remote denial of service, causing the DNS server to become unresponsive and potentially disrupting services relying on DNS resolution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, you can implement firewall rules to restrict access to the DNS server from untrusted sources as a temporary workaround.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
