RHSA-2026:87309
Vulnerability from csaf_redhat - Published: 2026-10-21 18:39 - Updated: 2026-10-22 06:03Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
bind:
* bind-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-chroot-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-devel-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-dnssec-utils-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-doc-9.20.30-0.1.hum1 (noarch)
* bind-libs-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-utils-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)
* bind-9.20.30-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.
8.1 (High)
Affected products
Fixed
22 products, the same list as for
CVE-2026-19630
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.
7.5 (High)
Affected products
Fixed
22 products, the same list as for
CVE-2026-19630
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.
7.5 (High)
Affected products
Fixed
22 products, the same list as for
CVE-2026-19630
Threats
Impact
Important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nbind:\n * bind-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-chroot-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-devel-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-dnssec-utils-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-doc-9.20.30-0.1.hum1 (noarch)\n * bind-libs-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-utils-9.20.30-0.1.hum1 (aarch64, s390x, x86_64)\n * bind-9.20.30-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:87309",
"url": "https://access.redhat.com/errata/RHSA-2026:87309"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-97313",
"url": "https://access.redhat.com/security/cve/CVE-2026-97313"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-96888",
"url": "https://access.redhat.com/security/cve/CVE-2026-96888"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-94300",
"url": "https://access.redhat.com/security/cve/CVE-2026-94300"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19630",
"url": "https://access.redhat.com/security/cve/CVE-2026-19630"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87309.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-22T06:03:09+00:00",
"generator": {
"date": "2026-10-22T06:03:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:87309",
"initial_release_date": "2026-10-21T18:39:20+00:00",
"revision_history": [
{
"date": "2026-10-21T18:39:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-21T19:34:19+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-22T06:03:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-devel-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-devel-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-devel-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-devel@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-libs-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-libs-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.20.30-0.1.hum1@aarch64",
"product": {
"name": "bind-utils-32:9.20.30-0.1.hum1@aarch64",
"product_id": "bind-utils-32:9.20.30-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.20.30-0.1.hum1?arch=aarch64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-chroot-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-devel-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-devel-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-devel-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-devel@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-libs-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-libs-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.20.30-0.1.hum1@s390x",
"product": {
"name": "bind-utils-32:9.20.30-0.1.hum1@s390x",
"product_id": "bind-utils-32:9.20.30-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.20.30-0.1.hum1?arch=s390x\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.20.30-0.1.hum1@src",
"product": {
"name": "bind-32:9.20.30-0.1.hum1@src",
"product_id": "bind-32:9.20.30-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.20.30-0.1.hum1?arch=src\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-chroot@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-devel-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-devel-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-devel-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-devel@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-dnssec-utils@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-libs-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-libs-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-libs-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-libs@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-utils-32:9.20.30-0.1.hum1@x86_64",
"product": {
"name": "bind-utils-32:9.20.30-0.1.hum1@x86_64",
"product_id": "bind-utils-32:9.20.30-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-utils@9.20.30-0.1.hum1?arch=x86_64\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-doc@9.20.30-0.1.hum1?arch=noarch\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-doc@9.20.30-0.1.hum1?arch=noarch\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-doc@9.20.30-0.1.hum1?arch=noarch\u0026epoch=32\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.20.30-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src"
},
"product_reference": "bind-32:9.20.30-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-chroot-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-chroot-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-devel-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-devel-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-devel-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-devel-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-devel-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-devel-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-libs-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-libs-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-libs-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-libs-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.20.30-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64"
},
"product_reference": "bind-utils-32:9.20.30-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.20.30-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x"
},
"product_reference": "bind-utils-32:9.20.30-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-utils-32:9.20.30-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
},
"product_reference": "bind-utils-32:9.20.30-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-19630",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-20T19:42:24.891000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556406"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU and memory resources without requiring privileges, resulting in a denial of service. In Red Hat Enterprise Linux and OpenShift environments, the risk primarily affects BIND instances functioning as recursive resolvers exposed to untrusted traffic. Deployments serving strictly authoritative roles or those isolated from untrusted client queries experience significantly lower exposure to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19630"
},
{
"category": "external",
"summary": "RHBZ#2556406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556406"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19630"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19630",
"url": "https://kb.isc.org/docs/cve-2026-19630"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T18:39:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87309"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages"
},
{
"cve": "CVE-2026-94300",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"discovery_date": "2026-10-20T19:46:35.830000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as Important rather than Critical because, while remote unauthenticated code execution is possible, exploitation depends on capturing active cryptographic keys within their validity window and orchestrating complex concurrent requests. In standard Red Hat Enterprise Linux deployments, the BIND daemon does not enable GSS-TSIG by default, restricting risk primarily to servers integrated with Kerberos-based identity infrastructure like FreeIPA or Active Directory. Deployments that do not negotiate GSS-TSIG keys or that strictly limit dynamic DNS access to trusted networks remain unexposed to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94300"
},
{
"category": "external",
"summary": "RHBZ#2556407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94300"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-94300",
"url": "https://kb.isc.org/docs/cve-2026-94300"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T18:39:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87309"
},
{
"category": "workaround",
"details": "Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls.\n\nTo disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service:\n\nsystemctl restart named\n\nIf operating named inside a chroot environment, execute:\n\nsystemctl restart named-chroot\n\nAlternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access.\n\nCaveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment.\nWarning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay"
},
{
"cve": "CVE-2026-96888",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-19T18:50:52.794000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556413"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of Service via assertion failure during redirect processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger a denial of service by causing the named daemon to crash without prior privileges. Exploitation is restricted to recursive resolvers where administrators have explicitly configured redirect zones alongside strict query name minimization. Standard Red Hat Enterprise Linux installations do not employ these non-default settings out of the box, significantly limiting exposure on typical systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96888"
},
{
"category": "external",
"summary": "RHBZ#2556413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556413"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96888"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-96888",
"url": "https://kb.isc.org/docs/cve-2026-96888"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T18:39:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87309"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of Service via assertion failure during redirect processing"
},
{
"cve": "CVE-2026-97313",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-20T19:57:36.315000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556415"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of service via assertion failure in RPZ query processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can crash the BIND name service, causing a denial of service for all dependent infrastructure. Exploitation requires a specific, non-default deployment where recursive queries are permitted alongside multiple response policy zones configured with conflicting recursive-only options. Default Red Hat Enterprise Linux configurations do not define response policy zones and are therefore not exposed unless administrators have explicitly implemented this combination of policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97313"
},
{
"category": "external",
"summary": "RHBZ#2556415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556415"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-97313",
"url": "https://kb.isc.org/docs/cve-2026-97313"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-21T18:39:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:87309"
},
{
"category": "workaround",
"details": "Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies.\n\nAlternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL).\n\nAfter modifying the configuration, validate the syntax and reload the service:\n\n```\nnamed-checkconf\nsystemctl reload named\n```\n\nCaveats:\nAligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups.\n\nWarning:\nReloading or restarting the `named` service may cause a momentary pause in active DNS query processing.",
"product_ids": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@src",
"Red Hat Hardened Images:bind-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-chroot-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-devel-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-dnssec-utils-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:bind-doc-32:9.20.30-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-libs-32:9.20.30-0.1.hum1@x86_64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@aarch64",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@s390x",
"Red Hat Hardened Images:bind-utils-32:9.20.30-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of service via assertion failure in RPZ query processing"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.