RHSA-2026:68279

Vulnerability from csaf_redhat - Published: 2026-09-16 15:32 - Updated: 2026-09-21 11:31
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: bind: * bind-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-chroot-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-devel-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-dnssec-utils-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-doc-9.20.29-0.1.hum1 (noarch) * bind-libs-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-utils-9.20.29-0.1.hum1 (aarch64, x86_64) * bind-9.20.29-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-19033

A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The `named` process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, `named` does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity.

6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-19662

A flaw was found in BIND 9. A remote attacker can cause a `named` resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker's authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver's abortion.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-19666

A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-19667

A flaw was found in `bind9`'s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-19668

A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-19941

A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC (Next Secure) record to a `named` resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS (Domain Name System) record, potentially leading to a misrepresentation of DNS information.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-75029

A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the `named` service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service (DoS) due to memory exhaustion.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-76163

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending a specially crafted TKEY query to a BIND server configured without a global 'options' block in its 'named.conf' file. This can lead to an assertion failure, causing the BIND program to unexpectedly terminate. This results in a Denial of Service (DoS), making the affected server unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-77119

A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-290 - Authentication Bypass by Spoofing
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-77692

A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker can exploit this vulnerability by sending a specially crafted DNS-over-HTTPS (DoH) request containing an invalid SIG(0) record. This action, combined with prematurely closing the connection, can cause the `named` daemon to unexpectedly terminate, leading to a Denial of Service (DoS) for affected systems.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-78301

A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services.

5.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
CWE-168 - Improper Handling of Inconsistent Special Elements
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Moderate
CVE-2026-80274

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-81563

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeated exploitation would prevent the resolver from performing new recursive lookups, resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
CVE-2026-81736

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response, leading to a denial of service (DoS) condition. This can make the affected BIND 9 resolver unresponsive to legitimate requests.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 15 products, the same list as for CVE-2026-19033
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:68279 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-81736 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-76163 external
https://access.redhat.com/security/cve/CVE-2026-78301 external
https://access.redhat.com/security/cve/CVE-2026-75029 external
https://access.redhat.com/security/cve/CVE-2026-80274 external
https://access.redhat.com/security/cve/CVE-2026-81563 external
https://access.redhat.com/security/cve/CVE-2026-77692 external
https://access.redhat.com/security/cve/CVE-2026-19666 external
https://access.redhat.com/security/cve/CVE-2026-19668 external
https://access.redhat.com/security/cve/CVE-2026-19033 external
https://access.redhat.com/security/cve/CVE-2026-19662 external
https://access.redhat.com/security/cve/CVE-2026-19667 external
https://access.redhat.com/security/cve/CVE-2026-19941 external
https://access.redhat.com/security/cve/CVE-2026-77119 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-19033 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535479 external
https://www.cve.org/CVERecord?id=CVE-2026-19033 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19033 external
https://downloads.isc.org/isc/bind9/9.20.29 external
https://downloads.isc.org/isc/bind9/9.21.26 external
https://kb.isc.org/docs/cve-2026-19033 external
https://access.redhat.com/security/cve/CVE-2026-19662 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535445 external
https://www.cve.org/CVERecord?id=CVE-2026-19662 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19662 external
https://kb.isc.org/docs/cve-2026-19662 external
https://access.redhat.com/security/cve/CVE-2026-19666 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535477 external
https://www.cve.org/CVERecord?id=CVE-2026-19666 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19666 external
https://kb.isc.org/docs/cve-2026-19666 external
https://access.redhat.com/security/cve/CVE-2026-19667 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535435 external
https://www.cve.org/CVERecord?id=CVE-2026-19667 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19667 external
https://kb.isc.org/docs/cve-2026-19667 external
https://access.redhat.com/security/cve/CVE-2026-19668 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535476 external
https://www.cve.org/CVERecord?id=CVE-2026-19668 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19668 external
https://kb.isc.org/docs/cve-2026-19668 external
https://access.redhat.com/security/cve/CVE-2026-19941 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535457 external
https://www.cve.org/CVERecord?id=CVE-2026-19941 external
https://nvd.nist.gov/vuln/detail/CVE-2026-19941 external
https://kb.isc.org/docs/cve-2026-19941 external
https://access.redhat.com/security/cve/CVE-2026-75029 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535468 external
https://www.cve.org/CVERecord?id=CVE-2026-75029 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75029 external
https://kb.isc.org/docs/cve-2026-75029 external
https://access.redhat.com/security/cve/CVE-2026-76163 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535467 external
https://www.cve.org/CVERecord?id=CVE-2026-76163 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76163 external
https://kb.isc.org/docs/cve-2026-76163 external
https://access.redhat.com/security/cve/CVE-2026-77119 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535469 external
https://www.cve.org/CVERecord?id=CVE-2026-77119 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77119 external
https://kb.isc.org/docs/cve-2026-77119 external
https://access.redhat.com/security/cve/CVE-2026-77692 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535462 external
https://www.cve.org/CVERecord?id=CVE-2026-77692 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77692 external
https://kb.isc.org/docs/cve-2026-77692 external
https://access.redhat.com/security/cve/CVE-2026-78301 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535463 external
https://www.cve.org/CVERecord?id=CVE-2026-78301 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78301 external
https://kb.isc.org/docs/cve-2026-78301 external
https://access.redhat.com/security/cve/CVE-2026-80274 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535466 external
https://www.cve.org/CVERecord?id=CVE-2026-80274 external
https://nvd.nist.gov/vuln/detail/CVE-2026-80274 external
https://kb.isc.org/docs/cve-2026-80274 external
https://access.redhat.com/security/cve/CVE-2026-81563 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535461 external
https://www.cve.org/CVERecord?id=CVE-2026-81563 external
https://nvd.nist.gov/vuln/detail/CVE-2026-81563 external
https://kb.isc.org/docs/cve-2026-81563 external
https://access.redhat.com/security/cve/CVE-2026-81736 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535432 external
https://www.cve.org/CVERecord?id=CVE-2026-81736 external
https://nvd.nist.gov/vuln/detail/CVE-2026-81736 external
https://kb.isc.org/docs/cve-2026-81736 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nbind:\n  * bind-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-chroot-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-devel-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-dnssec-utils-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-doc-9.20.29-0.1.hum1 (noarch)\n  * bind-libs-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-utils-9.20.29-0.1.hum1 (aarch64, x86_64)\n  * bind-9.20.29-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68279",
        "url": "https://access.redhat.com/errata/RHSA-2026:68279"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-81736",
        "url": "https://access.redhat.com/security/cve/CVE-2026-81736"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76163",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76163"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78301",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78301"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75029",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75029"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80274",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80274"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-81563",
        "url": "https://access.redhat.com/security/cve/CVE-2026-81563"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77692",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77692"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19666",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19666"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19668",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19033",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19033"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19662",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19662"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19667",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19667"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-19941",
        "url": "https://access.redhat.com/security/cve/CVE-2026-19941"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77119",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77119"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68279.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-21T11:31:27+00:00",
      "generator": {
        "date": "2026-09-21T11:31:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68279",
      "initial_release_date": "2026-09-16T15:32:09+00:00",
      "revision_history": [
        {
          "date": "2026-09-16T15:32:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T17:59:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-21T11:31:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bind-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-chroot-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-chroot-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-chroot-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-chroot@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-devel-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-devel-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-devel-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-devel@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-dnssec-utils@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-libs-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-libs-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-libs-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-libs@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-utils-0:9.20.29-0.1.hum1@aarch64",
                "product": {
                  "name": "bind-utils-0:9.20.29-0.1.hum1@aarch64",
                  "product_id": "bind-utils-0:9.20.29-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-utils@9.20.29-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bind-0:9.20.29-0.1.hum1@src",
                "product": {
                  "name": "bind-0:9.20.29-0.1.hum1@src",
                  "product_id": "bind-0:9.20.29-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind@9.20.29-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bind-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-chroot-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-chroot-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-chroot-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-chroot@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-devel-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-devel-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-devel-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-devel@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-dnssec-utils@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-libs-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-libs-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-libs-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-libs@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-utils-0:9.20.29-0.1.hum1@x86_64",
                "product": {
                  "name": "bind-utils-0:9.20.29-0.1.hum1@x86_64",
                  "product_id": "bind-utils-0:9.20.29-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-utils@9.20.29-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-doc@9.20.29-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/bind-doc@9.20.29-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-0:9.20.29-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src"
        },
        "product_reference": "bind-0:9.20.29-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-chroot-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-chroot-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-chroot-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-chroot-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-devel-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-devel-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-devel-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-devel-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-libs-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-libs-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-libs-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-libs-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-utils-0:9.20.29-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64"
        },
        "product_reference": "bind-utils-0:9.20.29-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bind-utils-0:9.20.29-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        },
        "product_reference": "bind-utils-0:9.20.29-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-19033",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-09-16T14:35:16.203051+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535479"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The `named` process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, `named` does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This vulnerability allows an attacker to provide unauthorized zone content to a secondary BIND server if it is configured for multi-message TCP IXFR transfers with TSIG restrictions. While TSIG is intended to secure zone transfers, the flaw prevents `named` from rolling back changes when a valid signature is not received, leading to potential data integrity issues.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19033"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535479",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535479"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19033"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19033",
          "url": "https://kb.isc.org/docs/cve-2026-19033"
        }
      ],
      "release_date": "2026-09-16T14:10:08.535000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas"
    },
    {
      "cve": "CVE-2026-19662",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-16T14:05:04.129115+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535445"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9. A remote attacker can cause a `named` resolver to stop functioning (Denial of Service) by inducing the victim resolver to send multiple queries for a DNSSEC-signed zone. If the attacker\u0027s authoritative server responds with a specific sequence of crafted answers that arrive with particular timing, a use-after-free vulnerability is triggered, leading to the resolver\u0027s abortion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact denial of service vulnerability in BIND 9\u0027s `named` resolver can lead to service unavailability. Exploitation requires an attacker to operate an authoritative DNS server and specifically induce a vulnerable resolver to query it for a DNSSEC-signed zone. The attack relies on a precise sequence and timing of crafted DNSSEC responses, limiting its broader applicability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19662"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535445",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535445"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19662",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19662"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19662",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19662"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19662",
          "url": "https://kb.isc.org/docs/cve-2026-19662"
        }
      ],
      "release_date": "2026-09-16T13:50:10.432000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, consider disabling DNSSEC validation on `named` resolvers if it is not a strict requirement for your environment. This can be achieved by setting `dnssec-validation no;` in the `named.conf` file. Disabling DNSSEC validation will prevent the resolver from processing DNSSEC-signed zones, thereby avoiding this specific vulnerability, but it will also remove the security benefits provided by DNSSEC. After modifying the configuration, the `named` service must be reloaded or restarted for the changes to take effect.\n\n`sudo systemctl reload named`\n`sudo systemctl restart named`",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses"
    },
    {
      "cve": "CVE-2026-19666",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-09-16T14:34:53.189451+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535477"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via malformed DNS64 responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This denial of service vulnerability affects BIND resolvers configured to use the `dns64` feature. A specially crafted malformed DNS64 response from an authoritative server can cause the `named` process to unexpectedly terminate, leading to service unavailability. Exploitation requires the `dns64` feature to be explicitly enabled in the resolver\u0027s configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19666"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535477",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535477"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19666",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19666"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19666",
          "url": "https://kb.isc.org/docs/cve-2026-19666"
        }
      ],
      "release_date": "2026-09-16T14:02:30.453000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via malformed DNS64 responses"
    },
    {
      "cve": "CVE-2026-19667",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535435"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `bind9`\u0027s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in BIND 9\u0027s `named` service. An attacker-controlled authoritative server can trigger a `named` abort by sending a precisely sized negative DNS answer. This vulnerability primarily affects BIND instances configured as recursive resolvers that query untrusted authoritative servers, leading to service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19667"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535435",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535435"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19667",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19667"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19667",
          "url": "https://kb.isc.org/docs/cve-2026-19667"
        }
      ],
      "release_date": "2026-09-16T13:46:56.783000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers.\n\nExample configuration in `named.conf`:\n```\noptions {\n    forwarders { 192.0.2.1; 192.0.2.2; };\n    forward only;\n};\n```\nReplace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling"
    },
    {
      "cve": "CVE-2026-19668",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-16T14:34:35.222210+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535476"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via invalid DNSSEC records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in BIND recursive resolvers can lead to a denial of service due to excessive resource consumption when processing specific invalid DNSSEC records. Red Hat\u0027s default BIND configurations include `max-records-per-type` and `max-types-per-name` limits, which help reduce the exposure and prevent a more severe impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19668"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535476",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535476"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19668",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19668"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19668",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19668"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19668",
          "url": "https://kb.isc.org/docs/cve-2026-19668"
        }
      ],
      "release_date": "2026-09-16T14:12:34.380000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate potential denial of service, ensure that the BIND recursive resolver\u0027s configuration includes appropriate limits for `max-records-per-type` and `max-types-per-name` within the `named.conf` file. These settings help control resource consumption when encountering invalid DNSSEC records. A restart of the `named` service is required for any configuration changes to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: BIND: Denial of Service via invalid DNSSEC records"
    },
    {
      "cve": "CVE-2026-19941",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-09-16T14:11:11.588899+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535457"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC (Next Secure) record to a `named` resolver. This could allow the attacker to mask the existence of a victim\u0027s wildcard DNS (Domain Name System) record, potentially leading to a misrepresentation of DNS information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in BIND 9 allows a remote attacker to mask the existence of DNS wildcard records by providing specially crafted NSEC records to a `named` resolver. While the attack complexity is high, successful exploitation could lead to a misrepresentation of DNS information, potentially affecting services relying on accurate DNS resolution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-19941"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535457",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535457"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19941",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-19941"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19941",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19941"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-19941",
          "url": "https://kb.isc.org/docs/cve-2026-19941"
        }
      ],
      "release_date": "2026-09-16T13:52:49.400000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records"
    },
    {
      "cve": "CVE-2026-75029",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-16T14:31:43.609241+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535468"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9. A remote attacker could send multiple copies of a single record in a query response to the `named` service. This could lead to increased memory usage in the negative cache, potentially causing a Denial of Service (DoS) due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND 9: Denial of Service via crafted query responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact denial of service vulnerability in BIND 9 allows a remote attacker to exhaust memory resources by sending crafted query responses containing duplicate records. This can lead to increased memory usage in the negative cache, potentially disrupting DNS services on affected Red Hat systems running BIND.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75029"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535468",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535468"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75029",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75029"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75029",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75029"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-75029",
          "url": "https://kb.isc.org/docs/cve-2026-75029"
        }
      ],
      "release_date": "2026-09-16T14:15:12.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the BIND `named` service to only trusted clients and networks. Implement firewall rules to limit incoming UDP/TCP port 53 traffic to known, legitimate sources. This reduces the attack surface by preventing untrusted external entities from sending crafted query responses.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: BIND 9: Denial of Service via crafted query responses"
    },
    {
      "cve": "CVE-2026-76163",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-09-16T14:31:26.156838+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending a specially crafted TKEY query to a BIND server configured without a global \u0027options\u0027 block in its \u0027named.conf\u0027 file. This can lead to an assertion failure, causing the BIND program to unexpectedly terminate. This results in a Denial of Service (DoS), making the affected server unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via TKEY query with specific configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in BIND. If the `named.conf` file lacks a global `options` block, a remote attacker can send a crafted TKEY query, leading to an assertion failure and unexpected program termination. This issue impacts the availability of the DNS service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76163"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76163",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76163"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76163",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76163"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-76163",
          "url": "https://kb.isc.org/docs/cve-2026-76163"
        }
      ],
      "release_date": "2026-09-16T14:05:34.811000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that the BIND configuration file (`named.conf`) includes a global `options` block. If no such block exists, adding an empty `options {}` block will prevent the vulnerability. After modifying `named.conf`, the `named` service must be restarted for the changes to take effect. This may temporarily interrupt DNS resolution.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via TKEY query with specific configuration"
    },
    {
      "cve": "CVE-2026-77119",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-09-16T14:32:02.729341+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9. A remote attacker could exploit a vulnerability where a validly signed NSEC3 record from an unrelated DNS zone might be accepted as proof of insecurity. This could downgrade a secure delegation, allowing forged unsigned DNS answers to be accepted by the resolver, potentially leading to DNS spoofing or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind9: bind: BIND 9: DNSSEC bypass via NSEC3 insecure-referral proof",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has a Moderate impact on Red Hat products. A flaw in BIND 9 allows a remote attacker to bypass DNSSEC validation by accepting an NSEC3 record from an unrelated zone, leading to the acceptance of forged unsigned DNS answers. The attack complexity is high, limiting the ease of exploitation and contributing to its Moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77119"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535469",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535469"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77119",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77119"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77119",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77119"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-77119",
          "url": "https://kb.isc.org/docs/cve-2026-77119"
        }
      ],
      "release_date": "2026-09-16T14:17:11.956000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind9: bind: BIND 9: DNSSEC bypass via NSEC3 insecure-referral proof"
    },
    {
      "cve": "CVE-2026-77692",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-09-16T14:21:59.543988+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535462"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker can exploit this vulnerability by sending a specially crafted DNS-over-HTTPS (DoH) request containing an invalid SIG(0) record. This action, combined with prematurely closing the connection, can cause the `named` daemon to unexpectedly terminate, leading to a Denial of Service (DoS) for affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A remote denial of service vulnerability exists in the BIND `named` service. An attacker can send a specially crafted DNS-over-HTTPS request with an invalid SIG(0) record and prematurely close the connection, causing the `named` process to abort. This can lead to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77692"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535462",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535462"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77692",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77692"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77692",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77692"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-77692",
          "url": "https://kb.isc.org/docs/cve-2026-77692"
        }
      ],
      "release_date": "2026-09-16T13:55:45.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict access to the BIND service to trusted clients only, or disable DNS-over-HTTPS if it is not required.\nTo restrict network access to the BIND service, configure firewall rules to only allow connections from trusted IP ranges to port 53 (UDP and TCP). For example, using `firewalld`:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_RANGE\u003e\" port port=\"53\" protocol=\"udp\" accept\u0027`\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_RANGE\u003e\" port port=\"53\" protocol=\"tcp\" accept\u0027`\n`firewall-cmd --reload`\nIf DNS-over-HTTPS is enabled and not essential, consider disabling it in the BIND configuration. Refer to the BIND administrator\u0027s reference manual for instructions on disabling DNS-over-HTTPS. Changes to BIND configuration require a restart of the `named` service for them to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Remote Denial of Service via crafted DNS-over-HTTPS request"
    },
    {
      "cve": "CVE-2026-78301",
      "cwe": {
        "id": "CWE-168",
        "name": "Improper Handling of Inconsistent Special Elements"
      },
      "discovery_date": "2026-09-16T14:22:21.109055+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535463"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: DNS cache poisoning via malformed zone insertion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. BIND servers configured for both authoritative and recursive functions are vulnerable to DNS cache poisoning. An attacker who can insert a malformed zone, for example via zone transfer, can cause the server to cache attacker-supplied data for names outside the configured zone.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78301"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535463",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535463"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78301",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78301"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78301",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78301"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-78301",
          "url": "https://kb.isc.org/docs/cve-2026-78301"
        }
      ],
      "release_date": "2026-09-16T13:58:11.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Red Hat recommends separating authoritative and recursive DNS functions onto different BIND instances or servers. This prevents a compromised authoritative zone from affecting recursive queries. Additionally, restrict zone transfer sources to trusted hosts only by configuring `allow-transfer` directives within your `named.conf` zone definitions. After modifying `named.conf`, the BIND service must be reloaded for changes to take effect, which may temporarily interrupt DNS resolution.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bind: BIND: DNS cache poisoning via malformed zone insertion"
    },
    {
      "cve": "CVE-2026-80274",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-09-16T14:31:05.646441+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535466"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND: Denial of Service via crafted DNSSEC reply",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in BIND resolvers. When DNSSEC validation is enabled, a specially crafted DNSSEC reply from an authoritative server can cause the BIND resolver to unexpectedly exit, leading to a disruption of DNS resolution services. This impacts the availability of DNS resolution on affected Red Hat systems configured with DNSSEC.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80274"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535466",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535466"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80274",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80274"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-80274",
          "url": "https://kb.isc.org/docs/cve-2026-80274"
        }
      ],
      "release_date": "2026-09-16T14:07:20.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND: Denial of Service via crafted DNSSEC reply"
    },
    {
      "cve": "CVE-2026-81563",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-09-16T14:21:17.574382+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535461"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeated exploitation would prevent the resolver from performing new recursive lookups, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service vulnerability affects BIND resolvers, which are critical for DNS resolution in Red Hat environments. Repeated processing of specially crafted SVCB/HTTPS AliasMode records can exhaust internal resources, ultimately preventing the resolver from performing new recursive lookups and disrupting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-81563"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535461",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535461"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-81563",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81563"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81563",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81563"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-81563",
          "url": "https://kb.isc.org/docs/cve-2026-81563"
        }
      ],
      "release_date": "2026-09-16T14:00:04.129000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing"
    },
    {
      "cve": "CVE-2026-81736",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-09-16T13:51:16.566536+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response, leading to a denial of service (DoS) condition. This can make the affected BIND 9 resolver unresponsive to legitimate requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in BIND 9 resolvers. An attacker can remotely trigger excessive CPU consumption by querying a resolver that has cached a specific tree of SVCB/HTTPS AliasMode records. This can lead to service disruption, particularly for resolvers exposed to untrusted networks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
          "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
          "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-81736"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-81736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81736"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.20.29",
          "url": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "category": "external",
          "summary": "https://downloads.isc.org/isc/bind9/9.21.26",
          "url": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "category": "external",
          "summary": "https://kb.isc.org/docs/cve-2026-81736",
          "url": "https://kb.isc.org/docs/cve-2026-81736"
        }
      ],
      "release_date": "2026-09-16T13:44:28.052000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:32:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68279"
        },
        {
          "category": "workaround",
          "details": "To mitigate the risk of this denial of service, configure BIND resolvers to restrict recursive queries to trusted clients only. This can be achieved by setting the `allow-recursion` option in the `named.conf` configuration file to specific IP addresses or networks. After modifying the configuration, the `named` service must be reloaded for the changes to take effect, which may temporarily interrupt DNS resolution.",
          "product_ids": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@src",
            "Red Hat Hardened Images:bind-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-chroot-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-devel-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-dnssec-utils-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:bind-doc-0:9.20.29-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-libs-0:9.20.29-0.1.hum1@x86_64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@aarch64",
            "Red Hat Hardened Images:bind-utils-0:9.20.29-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.