Critical Security Update for BIND 9.18: Remote Denial of Service Vulnerabilities
Summary
ALSA-2026:75578: Important: bind9.18 security update. Affects bind9.18 versions < 32:9.18.29-14.el9_8.10. Fixed in 32:9.18.29-14.el9_8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is crucial for the functioning of the internet, and its security is paramount to prevent disruptions.
Vulnerability Detail
The BIND 9.18 package has multiple vulnerabilities that can lead to remote denial of service (DoS) attacks. These vulnerabilities arise from issues such as improper handling of cached SVCB/HTTPS AliasMode records, 16-bit length truncation in DNS negative cache handling, and resource exhaustion in SVCB/HTTPS AliasMode processing. Attackers can exploit these vulnerabilities to crash the DNS server or exhaust its resources, leading to service unavailability.
How To Fix
Minimum fixed version
32:9.18.29-14.el9_8.10
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the affected features in BIND until the package is updated. However, this is not a long-term solution and should be followed by an update as soon as possible.
Conclusion
The BIND 9.18 package has critical vulnerabilities that can lead to remote denial of service attacks. It is crucial to update to the patched version to ensure the security and availability of your DNS services. Utilize tools like Vulert to monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is an implementation of the DNS protocols, providing a DNS server and resolver library for applications.
Exploiting these vulnerabilities can lead to remote denial of service attacks, causing the DNS server to crash or become unresponsive.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring any signup.
If immediate updating is not possible, consider disabling the affected features as a temporary workaround.
More details can be found on the CVE pages linked in the advisory, which provide information on the impact and technical aspects of the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
