When resolving a domain with many nameservers that share overlapping IP addresses (e.g., 10 NS records all pointing at the same set of addresses), BIND could previously waste time querying duplicate addresses and build up excessively large server lists. Deduplicate addresses in the resolver's server list so that each unique IP is only queried once per resolution attempt, regardless of how many NS records point to it and cap the number of addresses stored per nameserver name to 6 (combined A and AAAA), preventing memory and CPU overhead from domains with unusually large NS/glue sets.
Closesisc-projects/bind9#5641
RH:
No tests are backported, because python tests have good enough support
for it.
Resolves: RHEL-189748
CVE: CVE-2026-3592
A bug during bad server handling could cause the resolver to enter an infinite loop, continuously sending queries to an upstream server with no exit condition, until the resolver query timeout was hit. This has been fixed.
ISC would like to thank Billy Baraja (BielraX) for bringing this issue to our attention.
Closesisc-projects/bind9#5804
Resolves: RHEL-189756
CVE: CVE-2026-5950
They contain merged _bindir and _sbindir and local builds fails. Allow
faster testing and compile even on later system with merged directories.
Related: RHEL-213768
Backport upstream fix for CVE-2026-10723 to bind-9.18.33.
The patch adds NSEC3 signer validation in dns_dnssec_verify()
to reject signatures whose signer field doesn't match the zone
owning the NSEC3 record. This prevents a child zone from
impersonating its parent zone and forging NXDOMAIN responses
for sibling domains. The error message for DNS_R_INVALIDNSEC3
is also updated to reflect the broader scope of the check.
CVE: CVE-2026-10723
Upstream patches:
- c9cb6a5e24.patch
Resolves: RHEL-215707
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch to reject out-of-zone NSEC next owner names, which
could allow a malicious zone to cover a victim zone for
non-existence in a DNSSEC validating resolver's cache, bypassing
DNSSEC validation (CVE-2026-13321).
The patch includes system tests, the upstream fix, and an
adaptation to the bind-9.18 codebase to resolve a compilation
issue with the cherry-picked commits.
CVE: CVE-2026-13321
Upstream patches:
- 36f3d50f9c.patch
Resolves: RHEL-213324
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 231b1ca3 to fix CVE-2026-11622 by
making dns_slabheaders in the cache reference counted.
Instead of only reference counting the enclosing node, reference
counting is added directly to slabheaders. This allows stale
slabheaders to be reclaimed as soon as their own reference count
reaches zero, rather than waiting for the whole node to become
unreferenced.
The patch (bind-9.18-CVE-2026-11622.patch) was cherry-picked
from upstream and adapted for the bind 9.18.33 codebase, added
as Patch232.
CVE: CVE-2026-11622
Upstream patches:
- 231b1ca3ed.patch
Resolves: RHEL-213384
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch for CVE-2026-11721: an RRSIG whose Labels field
indicates fewer labels than its signer name requires was being
accepted, allowing cache poisoning via forged wildcard records
through RFC 8198 synthesis. The patch is a two-commit mbox: the
original upstream fix plus an adaptation replacing the
DNS_NAME_VALID() macro (BIND 9.20+) with the equivalent
ISC_MAGIC_VALID() expression available in BIND 9.18.
CVE: CVE-2026-11721
Upstream patches:
- 8a46533cbe.patch
Resolves: RHEL-213411
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-11331 from upstream. The patch
corrects RPZ name-too-long wildcard expansion in
lib/ns/query.c by changing an `else if` to a standalone `if`,
so that when DNS_R_NAMETOOLONG is returned the function
properly returns the error result (YXDOMAIN response) instead
of falling through to return a self-referential CNAME with
the original address record.
CVE: CVE-2026-11331
Upstream patches:
- dc328a199f.patch
Resolves: RHEL-213768
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch for CVE-2026-13204 to prevent an assertion failure
(RUNTIME_CHECK crash) when processing malformed NSEC/NSEC3
responses. The upstream fix (commit 48f5aa5fb3) was adapted
for the bind-9.18 branch by replacing the undefined CHECK()
macro in lib/ns/query.c with its inline equivalent, ensuring
the error is handled gracefully via the cleanup path.
CVE: CVE-2026-13204
Upstream patches:
- 48f5aa5fb3.patch
Resolves: RHEL-213482
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Recursion, dynamic updates (UPDATE), and zone change notifications
(NOTIFY) are now disabled for views with a class other than IN
(such as CHAOS or HESIOD); authoritative service for non-IN zones
(e.g. version.bind in class CHAOS) continues to work as before.
Servers configured with recursion yes in a non-IN view will log a
warning at startup, and named-checkconf flags the same condition.
UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE
in the question section are now rejected with FORMERR.
This addresses a set of closely related security issues collectively
identified as CVE-2026-5946. ISC would like to thank Mcsky23 for
bringing these issues to our attention.
Resolves-Vulnerability: CVE-2026-5946
Resolves: RHEL-177671
Fixed a memory leak where each GSS-API TKEY negotiation leaked a security context inside the GSS library. An unauthenticated attacker could exhaust server memory by sending repeated TKEY queries to a server with tkey-gssapi-keytab configured. The leaked memory was allocated by the GSS library, bypassing BIND's memory accounting.
Multi-round GSS-API negotiation (GSS_S_CONTINUE_NEEDED) is now rejected, as BIND never supported it correctly and Kerberos/SPNEGO completes in a single round.
Also implemented missing RFC 3645 requirement: the client now verifies that mutual authentication and integrity flags are granted by the GSS-API mechanism (Section 3.1.1).
Resolves-Vulnerability: CVE-2026-3039
Resolves: RHEL-177758
DNSSEC-signed zones may contain high iteration-count NSEC3 records,
which prove that certain delegations are insecure. Previously, a
validating resolver encountering such a delegation processed these
iterations up to the number given, which could be a maximum of 65,535.
This has been addressed by introducing a processing limit, set at 150.
Now, if such an NSEC3 record is encountered, the delegation will be
treated as insecure.
ISC would like to thank Samy Medjahed/Ap4sh for bringing this
vulnerability to our attention.
Closesisc-projects/bind9#5708
Resolves-Vulnerability: CVE-2026-1519
One of libdir directories was forgotten. It is the directory containing
the actual plugin, might cause issues if filter-aaaa.so plugin is used.
Resolves: RHEL-132053
Imagemode might have separate /var partition not properly initialized by
package installation. Add creation of compat files into tmpfiles.d
definition.
Move primary place of those files from /var/named to /usr/shared/named, so we
even have some place to symlink them from. Originally it had only copy
in sample documentation, which may not be installed.
These source file should be read-only from named and not modified
anyway. Move them to /usr/share/named as read-only, always present
sources. Change compat symlinks in /var/named to point to them instead
of /etc.
Make the doc files only symlinks to those files too, have them there
just once.
Keep named.ca config file in /etc/named.ca
The rest can stay in _datadir, but named.ca can be potentially updated
and as such should remain in /etc and its modification kept.
Move primary copy into /etc and keep just legacy symlink inside
/var/named. Configuration should stay working if the file were modified.
Resolves: RHEL-97443
IDNA tests always redirect output into the file. That means its
behaviour has changed and is now processing IDN input by default and
just disables IDN output by default.
New behaviour when redirected is the same as +idnin +noidnout, but does
not fail hard on input errors.
Resolves: RHEL-112765
Use the same name in dig or host utilities when stdout is not a
terminal. Until now it disabled IDN processing when stdout were not a
terminal. Disable just IDN output in that case and try to decode input
name with IDN. Keep failing in interactive sessions, but send even
undecoded name query when output is redirected.
That should limit new surprises and keep most of behaviour without
changes. But do not break in when input name failed to decode and
it were not trying to decode it before.
Resolves: RHEL-112765
Many variants are never built anymore. Clean actions to just those still
shipped. But do not trigger named reload when named.run file is empty.
That is common on freeipa installation, where configuration changes
logging to put it elsewhere. named reload is disruptive because how
bind-dyndb-ldap behaves during reloads. Avoid unnecessary reloads with
visible service disruption.
Keep named-pkcs11 reload variant.
Resolves: RHEL-113960
NAMED_MAXADDITIONAL environment can change default limit of 13. Format
is just number of accepted NS, which will be processed for additional
records.
Resolves: RHEL-106784
When too many NS records are fetched from authoritative zone, limit
number of fetched additional records. Instead of not producing any
additional record when there is over 13 NS servers, limit number of
records for which those records would be fetched.
Resolves: RHEL-106784
Should allow PKCS11 provider used from dnssec-keyfromlabel and then from
signing tools or named daemon.
Use final Fedora version of backport. Fix also rsabigexponent test.
Resolves: RHEL-33729
resume_qmin did not handle special case of recursing query hit
unexpected DNS_R_CNAME result. Change result to SERVFAIL in case
of a zone loaded after the recursion started. That prevents crashing
later in query_setorder, where there is uninitialized foundname compared
with absolute order names.
https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
Resolves: RHEL-92084
Security Fixes:
- DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
- Limit additional section processing for large RDATA sets. (CVE-2024-11187)
New Features:
- Add a new option to configure the maximum number of outgoing queries per client request.
Bug Fixes:
- Fix nsupdate hang when processing a large update.
- Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
- Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
- Fix improper handling of unknown directives in resolv.conf.
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33
Resolves: RHEL-48798
Drop original user creating in favor of sysusers file definition.
(cherry picked from commit 071ec07d27989a8d548834292fa46ca2312b4862)
Related: RHEL-48798
- Remove CHANGES file from package
Removed Features:
- Disable DLZ plugins, they are not shipped with bind anymore
New Features:
- new 2024 KSK root key
Feature Changes:
- max-records-per-type and max-types-per-name improved logging when
reached over their value
And NSEC3 and two dig bug fixes.
https://downloads.isc.org/isc/bind9/9.18.32/doc/arm/html/notes.html#notes-for-bind-9-18-32
Resolves: RHEL-48798
Security Fixes
- A malicious DNS client that sent many queries over TCP but never read the responses could cause a server to respond slowly or not at all for other clients. This has been fixed. (CVE-2024-0760) [GL #4481]
- It is possible to craft excessively large resource records sets, which have the effect of slowing down database processing. This has been addressed by adding a configurable limit to the number of records that can be stored per name and type in a cache or zone database. The default is 100, which can be tuned with the new max-records-per-type option. [GL #497] [GL #3405]
It is possible to craft excessively large numbers of resource record types for a given owner name, which has the effect of slowing down database processing. This has been addressed by adding a configurable limit to the number of records that can be stored per name and type in a cache or zone database. The default is 100, which can be tuned with the new max-types-per-name option. (CVE-2024-1737) [GL #3403]
ISC would like to thank Toshifumi Sakaguchi who independently discovered and responsibly reported the issue to ISC. [GL #4548]
- Validating DNS messages signed using the SIG(0) protocol (RFC 2931) could cause excessive CPU load, leading to a denial-of-service condition. Support for SIG(0) message validation was removed from this version of named. (CVE-2024-1975) [GL #4480]
- Due to a logic error, lookups that triggered serving stale data and required lookups in local authoritative zone data could have resulted in an assertion failure. This has been fixed. (CVE-2024-4076) [GL #4507]
Potential data races were found in our DoH implementation, related to HTTP/2 session object management and endpoints set object management after reconfiguration. These issues have been fixed. [GL #4473]
ISC would like to thank Dzintars and Ivo from nic.lv for bringing this to our attention.
When looking up the NS records of parent zones as part of looking up DS records, it was possible for named to trigger an assertion failure if serve-stale was enabled. This has been fixed. [GL #4661]
And bugfixes.
https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html
Resolves: RHEL-48798
New Features
- A new option signatures-jitter has been added to dnssec-policy to allow
signature expirations to be spread out over a period of time. [GL #4554]
Feature Changes
- DNSSEC signatures that are not valid because the current time falls
outside the signature inception and expiration dates are skipped
instead of causing an immediate validation failure. [GL #4586]
https://downloads.isc.org/isc/bind9/9.18.27/doc/arm/html/notes.html#notes-for-bind-9-18-27
Fixes security issues reported in:
https://downloads.isc.org/isc/bind9/9.18.24/doc/arm/html/notes.html#security-fixes
- Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU
load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387)
ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner
from the German National Research Center for Applied Cybersecurity ATHENE for bringing
this vulnerability to our attention. [GL #4424]
Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to
a denial-of-service condition. This has been fixed. (CVE-2023-50868) [GL #4459]
Parsing DNS messages with many different names could cause excessive CPU load.
This has been fixed. (CVE-2023-4408)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr
from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt
from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234]
Specific queries could cause named to crash with an assertion failure when
nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281]
A bad interaction between DNS64 and serve-stale could cause named to crash with
an assertion failure, when both of these features were enabled. This has been fixed.
(CVE-2023-5679) [GL #4334]
Under certain circumstances, the DNS-over-TLS client code incorrectly attempted to
process more than one DNS message at a time, which could cause named to crash with
an assertion failure. This has been fixed. [GL #4487]
Increased release to be higher than c9s bind9.18 component.
; Resolves: CVE-2023-4408 CVE-2023-50387 CVE-2023-50868 CVE-2023-5517 CVE-2023-5679
Resolves: RHEL-48798
