Backport upstream fix for CVE-2026-10723 to bind-9.16.23.
The patch adds NSEC3 signer validation in lib/dns/dnssec.c,
rejecting signatures whose signer doesn't match the owning
zone apex. This prevents a child zone from impersonating its
parent and forging NXDOMAIN responses for sibling domains.
CVE: CVE-2026-10723
Upstream patches:
- 238ec379e9.patch
Resolves: RHEL-213499
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit af84538a2ce6 to fix CVE-2026-13321.
The patch adds validation in dns_dnssec_verify() to reject
out-of-zone NSEC next owner names by checking that the NSEC
next name is a subdomain of the signer field, as required by
RFC 4034 section 4.1.1.
CVE: CVE-2026-13321
Upstream patches:
- af84538a2c.patch
Resolves: RHEL-213313
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit c57695da31 ("Make the dns_slabheaders
in the cache reference counted") to fix CVE-2026-11622, a
use-after-free vulnerability in the DNS cache.
The patch adds reference counting to dns_slabheaders so stale
headers can be safely reclaimed independently of their enclosing
node. It modifies core cache code (rbtdb.c, rdataslab.h) and
updates the reclimit system test. Four hunks required manual
conflict resolution due to downstream PKCS11-related differences.
CVE: CVE-2026-11622
Upstream patches:
- c57695da31.patch
Resolves: RHEL-213396
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-11721 to bind9.16-9.16.23. Two upstream
commits were cherry-picked:
1. Reject RRSIG records whose Labels field indicates fewer labels
than the signer name requires, preventing cache poisoning via
forged wildcard records.
2. Prevent dnssec-signzone from signing extraneous records that
are not within the zone namespace.
CVE: CVE-2026-11721
Upstream patches:
- 15089066b1.patch
- 1a4986e253.patch
Resolves: RHEL-213406
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-11331 to bind9.16. The patch
(from upstream commit ee2ac186bc) corrects the query_rpzcname()
function in lib/ns/query.c to properly handle RPZ name-too-long
wildcard expansion by returning YXDOMAIN instead of a
self-referential CNAME.
CVE: CVE-2026-11331
Upstream patches:
- ee2ac186bc.patch
Resolves: RHEL-213764
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-13204 to bind9.16. The patch
ensures that dns_rdataset_addnoqname() only accepts NSEC/NSEC3
records that have matching RRSIG signatures, preventing
acceptance of unsigned records. Additionally, callers in
resolver.c and query.c now handle non-success return codes
gracefully instead of triggering assertion failures.
CVE: CVE-2026-13204
Upstream patches:
- 1b90fbb4f9.patch
Resolves: RHEL-213478
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Recursion, dynamic updates (UPDATE), and zone change notifications
(NOTIFY) are now disabled for views with a class other than IN
(such as CHAOS or HESIOD); authoritative service for non-IN zones
(e.g. version.bind in class CHAOS) continues to work as before.
Servers configured with recursion yes in a non-IN view will log a
warning at startup, and named-checkconf flags the same condition.
UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE
in the question section are now rejected with FORMERR.
This addresses a set of closely related security issues collectively
identified as CVE-2026-5946. ISC would like to thank Mcsky23 for
bringing these issues to our attention.
[9.16] fix: dev: Pass empty string instead of NULL to ns_client_dumpmessage()
Pass "" instead of NULL to ns_client_dumpmessage() to get the log message printed.
Resolves-Vulnerability: CVE-2026-5946
Resolves: RHEL-177651
Fixed a memory leak where each GSS-API TKEY negotiation leaked a security context inside the GSS library. An unauthenticated attacker could exhaust server memory by sending repeated TKEY queries to a server with tkey-gssapi-keytab configured. The leaked memory was allocated by the GSS library, bypassing BIND's memory accounting.
Multi-round GSS-API negotiation (GSS_S_CONTINUE_NEEDED) is now rejected, as BIND never supported it correctly and Kerberos/SPNEGO completes in a single round.
Also implemented missing RFC 3645 requirement: the client now verifies that mutual authentication and integrity flags are granted by the GSS-API mechanism (Section 3.1.1).
Resolves-Vulnerability: CVE-2026-3039
Resolves: RHEL-177667
DNSSEC-signed zones may contain high iteration-count NSEC3 records,
which prove that certain delegations are insecure. Previously, a
validating resolver encountering such a delegation processed these
iterations up to the number given, which could be a maximum of 65,535.
This has been addressed by introducing a processing limit, set at 150.
Now, if such an NSEC3 record is encountered, the delegation will be
treated as insecure.
ISC would like to thank Samy Medjahed/Ap4sh for bringing this
vulnerability to our attention.
Closes isc-projects/bind9#5708
Backport of MR !935
Resolves-Vulnerability: CVE-2026-1519
Resolves: RHEL-160108
Intended to be run like:
centpkg mockbuild --with SYSTEMTEST -N --enable-network
Do fail when it does not pass. But allow running tests as root.
Related: RHEL-77103
When answering queries, don't add data to the additional section if
the answer has more than 13 names in the RDATA. This limits the
number of lookups into the database(s) during a single client query,
reducing query processing load.
Also, don't append any additional data to type=ANY queries. The
answer to ANY is already big enough.
Fix vulnerability test backport
Vulnerability: CVE-2024-11187
Resolves: RHEL-77103
Fix local rebuilds on Fedora. BIND 9.16 does not work well with fortify
source level 3. Fix also DEFAULT_HMAC not properly set in tests, failing
reclimit test. That was issue only of backport.
Resolves: RHEL-50591
This aligns the fix for large number of RRs in RRSet with 9.18 and up
by backporting to `max-records-per-type` configuration option to
BIND 9.16.
Merge branch 'ondrej/max-types-per-rr-backport-9.16' into 'bind-9.16'
See merge request isc-projects/bind9!9178
Resolves: RHEL-50591
This aligns the fix for large number of RRs in RRSet with 9.18 and up
by backporting to `max-records-per-type` configuration option to
BIND 9.16.
Merge branch 'ondrej/max-records-per-type-backport-9.16' into 'bind-9.16'
See merge request isc-projects/bind9!9177
Remove also custom environment feature, which is not necessary with
proper config options backported.
Increase rightmost version to become higher than _4 suffix.
Resolves: RHEL-50591
Do not introduce new options into configuration file. But if limits are
hit in unexpected way, allow tuning them by environment variables
DNS_RDATASET_MAX_RECORDS and DNS_RBTDB_MAX_RTYPES. They accept number of
maximum records of types. Both defaults to 100.
These replaces max-records-per-type and max-types-per-name in later
versions. But can be configured only by environment and can be
configured only globally, not in each view or zone.
Related: RHEL-50591
6403. [security] qctx-zversion was not being cleared when it should have
been leading to an assertion failure if it needed to be
reused. (CVE-2024-4076) [GL #4507]
Resolves: RHEL-50874
6400. [security] Excessively large rdatasets can slow down database
query processing, so a limit has been placed on the
number of records that can be stored per rdataset
in a cache or zone database. This is configured
with the new "max-records-per-type" option, and
defaults to 100. (CVE-2024-1737)
[GL #497] [GL #3405]
6401. [security] An excessively large number of rrtypes per owner can
slow down database query processing, so a limit has been
placed on the number of rrtypes that can be stored per
owner (node) in a cache or zone database. This is
configured with the new "max-rrtypes-per-name" option,
and defaults to 100. (CVE-2024-1737)
[GL #3403] [GL #4548]
Does not change db methods like 9.18 fix. It makes limits set at build
time and fixed numbers, but does not need adjusting db interface to set
new limits.
Resolves: RHEL-50591
Fix of CVE-2023-6516 has changed format of map file and masterformat has
started crashing. Adjust test values to pass cleanly.
; Resolves: CVE-2023-6516
Resolves: RHEL-25381
Fix for CVE-2023-50387 introduced new additional thread. But because
isc_hp functions were removed from later bind 9.16 release, their
changes did not contain increase of hazard pointers max thread limit.
To prevent obscure memory corruption increase thread max size.
In addition place at least few INSISTs to check this is catched before
random memory overwrites begins. It would be quite difficult to track
without any check.
Resolves: RHEL-25392
; Resolves: CVE-2023-50387
This should make sure that the memory context is not destroyed
before the memory pool, which is using the context.
Related: RHEL-25392
; Related: CVE-2023-50387
Patch171 introduces undefined variables, which may fail some tests.
Define them to empty values. Also required python3-dns with SYSTEMTEST
feature enabled.
Related: RHEL-25348
; Related: CVE-2023-4408
More recent python3 module ply does not accept statements used in
isc/policy.py, which generates parsetab.py. Allow to skip that target on
local only fedora builds.
Related: RHEL-25348
; Related: CVE-2023-4408
KeyTrap - Extreme CPU consumption in DNSSEC validator. Preparing an
NSEC3 closest encloser proof can exhaust CPU resources.
6322. [security] Specific DNS answers could cause a denial-of-service
condition due to DNS validation taking a long time.
(CVE-2023-50387) [GL #4424]
Resolves: RHEL-25403 RHEL-25392
; Resolves: CVE-2023-50868 CVE-2023-50387
6319. [security] Query patterns that continuously triggered cache
database maintenance could exhaust all available memory
on the host running named. (CVE-2023-6516) [GL #4383]
Resolves: RHEL-25381
; Resolves: CVE-2023-6516
Enabling both DNS64 and serve-stale may cause an assertion failure
during recursive resolution.
6317. [security] Restore DNS64 state when handling a serve-stale timeout.
(CVE-2023-5679) [GL #4334]
Resolves: RHEL-25370
; Resolves: CVE-2023-5679
RFC 1918 reverse zones
6316. [security] Specific queries could trigger an assertion check with
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
Resolves: RHEL-25359
; Resolves: CVE-2023-5517
6315. [security] Speed up parsing of DNS messages with many different
names. (CVE-2023-4408) [GL #4234]
6321. [security] Change 6315 inadvertently introduced regressions that
could cause named to crash. [GL #4234]
6343. [bug] Fix case insensitive setting for isc_ht hashtable.
Resolves: RHEL-25348
; Resolves: CVE-2023-4408
6190. [security] Improve the overmem cleaning process to prevent the
cache going over the configured limit. (CVE-2023-2828)
[GL #4055]
Resolves: rhbz#2216654
