Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Bind DNS server may crash or be misled by attackers
published 1 month ago
Summary
The Bind DNS software used on Mageia systems has several weaknesses that could let an unauthenticated attacker cause the server to crash, consume resources, or accept false DNS data. These issues affect zone updates, cache handling, and new DNS features, potentially disrupting name resolution for your network. Apply the latest Bind package update from Mageia to fix these problems and keep your DNS service stable.
What to do
- Update mageia bind to version 9.20.29-1.mga10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Mageia:10 | mageia | bind |
< 9.20.29-1.mga10 Fix: upgrade to 9.20.29-1.mga10
|
Original advisory text
Updated bind package fixes security vulnerabilities
Unauthenticated IXFR deltas are applied to the live zone before TSIG
verification (CVE-2026-19033).
qpcache NOQNAME proof use-after-free crashes recursive resolver
(CVE-2026-19662).
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
(CVE-2026-19666).
Remote assertion failure via 16-bit length truncation in
dns_ncache_add() (CVE-2026-19667).
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
(CVE-2026-19668).
checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence
proof (CVE-2026-19941).
Message parser retains every identical singleton RDATA, enabling
wire-to-work amplification (CVE-2026-75029).
named aborts on a TKEY query when the user configuration has no global
options statement (CVE-2026-76163).
NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
(CVE-2026-77119).
Unauthenticated remote crash of named via a single DoH SIG(0) request
(CVE-2026-77692).
Out-of-zone database nodes can become authoritative zone cuts
(CVE-2026-78301).
Validating resolver can abort while caching a mismatched NOQNAME proof
(CVE-2026-80274).
SVCB AliasMode additional-data error leaks qpcache references
(CVE-2026-81563).
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
(CVE-2026-81736).
verification (CVE-2026-19033).
qpcache NOQNAME proof use-after-free crashes recursive resolver
(CVE-2026-19662).
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
(CVE-2026-19666).
Remote assertion failure via 16-bit length truncation in
dns_ncache_add() (CVE-2026-19667).
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
(CVE-2026-19668).
checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence
proof (CVE-2026-19941).
Message parser retains every identical singleton RDATA, enabling
wire-to-work amplification (CVE-2026-75029).
named aborts on a TKEY query when the user configuration has no global
options statement (CVE-2026-76163).
NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
(CVE-2026-77119).
Unauthenticated remote crash of named via a single DoH SIG(0) request
(CVE-2026-77692).
Out-of-zone database nodes can become authoritative zone cuts
(CVE-2026-78301).
Validating resolver can abort while caching a mismatched NOQNAME proof
(CVE-2026-80274).
SVCB AliasMode additional-data error leaks qpcache references
(CVE-2026-81563).
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
(CVE-2026-81736).
References
- https://advisories.mageia.org/MGASA-2026-0422.html Vendor Advisory
- https://bugs.mageia.org/show_bug.cgi?id=36326 Third Party Advisory
- https://kb.isc.org/docs/cve-2026-19033 URL
- https://kb.isc.org/docs/cve-2026-19662 URL
- https://kb.isc.org/docs/cve-2026-19666 URL
- https://kb.isc.org/docs/cve-2026-19667 URL
- https://kb.isc.org/docs/cve-2026-19668 URL
- https://kb.isc.org/docs/cve-2026-19941 URL
- https://kb.isc.org/docs/cve-2026-75029 URL
- https://kb.isc.org/docs/cve-2026-76163 URL
- https://kb.isc.org/docs/cve-2026-77119 URL
- https://kb.isc.org/docs/cve-2026-77692 URL
- https://kb.isc.org/docs/cve-2026-78301 URL
- https://kb.isc.org/docs/cve-2026-80274 URL
- https://kb.isc.org/docs/cve-2026-81563 URL
- https://kb.isc.org/docs/cve-2026-81736 URL
Timeline
Published20 Sep 2026
Updated20 Sep 2026
First seen20 Sep 2026
Sources
MGASA-2026-0422 · OSV
Track software like this
Free during beta