RHSA-2026:89746MediumCVSS 5.9

Red Hat Security Advisory: bind9.18 security update

Published
October 26, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-19662 →

📋 Description

CVE-2026-19662 — bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses

🎯 Affected products75

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-14.el9_8.11.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-chroot-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debuginfo-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bind9.18-debugsource-32:9.18.29-14.el9_8.11.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • bind9.18-devel-32:9.18.29-14.el9_8.11.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • +45 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, consider disabling DNSSEC validation on `named` resolvers if it is not a strict requirement for your environment. This can be achieved by setting `dnssec-validation no;` in the `named.conf` file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the `named` service must be reloaded or restarted for the changes to take effect. `sudo systemctl reload named` `sudo systemctl restart named`

🔗 References (4)