RHSA-2026:89745MediumCVSS 5.9

Red Hat Security Advisory: bind security update

Published
October 26, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-19662 →

📋 Description

CVE-2026-19662 — bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses

🎯 Affected products78

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-40.el9_8.12.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-chroot-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debuginfo-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind-debugsource-32:9.16.23-40.el9_8.12.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind-devel-32:9.16.23-40.el9_8.12.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • +48 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, consider disabling DNSSEC validation on `named` resolvers if it is not a strict requirement for your environment. This can be achieved by setting `dnssec-validation no;` in the `named.conf` file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the `named` service must be reloaded or restarted for the changes to take effect. `sudo systemctl reload named` `sudo systemctl restart named`

🔗 References (4)