RHSA-2026:6935
Vulnerability from csaf_redhat - Published: 2026-04-07 23:30 - Updated: 2026-04-19 19:41Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentially cause a denial of service (DoS) for legitimate DNS clients.
7.5 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
To reduce risk, restrict recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.
A flaw was found in bind. A remote attacker can send a specially crafted request that results in a corrupt or malicious record, causing the 'named' service to crash. This vulnerability leads to a Denial of Service (DoS) for authoritative servers and resolvers.
7.5 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records (RRs) in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache, redirecting clients to malicious domains or unauthorized servers.
8.6 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
While it is not possible to eliminate risk from this vulnerability, there are several options for reducing the risk. These include restricting recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.
A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator (PRNG). This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS responses into the resolver’s cache, causing clients to receive spoofed DNS data. Authoritative servers are generally unaffected, but recursive resolvers are exposed to this risk. Exploitation is remote and does not require user interaction.
8.6 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
To reduce risk, restrict recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.
A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service (DoS) for legitimate users.
7.5 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
To mitigate this issue, disable DNSSEC validation on affected BIND resolvers. Alternatively, configure the BIND server as authoritative-only if recursive queries are not required. Disabling DNSSEC validation may reduce the security posture of the DNS resolver. A restart of the BIND service (`named`) is required for these changes to take effect and may temporarily interrupt DNS resolution.
A flaw was found in the BIND resolver. A remote attacker can exploit this vulnerability by querying a specially crafted domain, which causes a memory leak. This memory leak can lead to a Denial of Service (DoS) condition, making the BIND resolver unavailable to legitimate users.
7.5 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
To mitigate this issue, restrict access to the BIND resolver to trusted clients only. This can be achieved by configuring firewall rules to limit inbound connections to port 53 (UDP/TCP) from known, authorized IP addresses or networks. Alternatively, configure BIND to listen only on specific trusted interfaces or localhost.
Example using firewalld:
`firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_NETWORK>" port port=53 protocol="udp" accept'`
`firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_NETWORK>" port port=53 protocol="tcp" accept'`
`firewall-cmd --reload`
After applying changes, a restart of the BIND service may be required for the new configuration to take full effect. This may temporarily interrupt DNS resolution services.
A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
To mitigate this issue, restrict access to the `named` service to only trusted networks and clients. If Transaction Signature (TSIG) keys are not actively used or required, consider disabling them in the BIND configuration. If TSIG keys are necessary, ensure they are securely managed and only distributed to authorized clients. After making configuration changes, a restart of the `named` service may be required to apply the changes, which could temporarily impact DNS resolution.
A flaw was found in BIND, specifically in the named server's handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources.
5.4 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:6935
Workaround
Restrict network access to the `named` service to trusted clients and networks. Configure firewall rules to limit inbound connections to the DNS service port (UDP/TCP 53). For example, using `firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_RANGE>" port port="53" protocol="udp" accept'` and `firewall-cmd --reload`. This action may impact DNS resolution for clients outside the specified trusted networks. A service reload or restart may be required for changes to take effect.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6935",
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-8677",
"url": "https://access.redhat.com/security/cve/CVE-2025-8677"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-40780",
"url": "https://access.redhat.com/security/cve/CVE-2025-40780"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-40778",
"url": "https://access.redhat.com/security/cve/CVE-2025-40778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13878",
"url": "https://access.redhat.com/security/cve/CVE-2025-13878"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3591",
"url": "https://access.redhat.com/security/cve/CVE-2026-3591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3119",
"url": "https://access.redhat.com/security/cve/CVE-2026-3119"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3104",
"url": "https://access.redhat.com/security/cve/CVE-2026-3104"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1519",
"url": "https://access.redhat.com/security/cve/CVE-2026-1519"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6935.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-04-19T19:41:47+00:00",
"generator": {
"date": "2026-04-19T19:41:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2026:6935",
"initial_release_date": "2026-04-07T23:30:26+00:00",
"revision_history": [
{
"date": "2026-04-07T23:30:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-18T19:59:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-19T19:41:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-main@aarch64",
"product": {
"name": "bind-main@aarch64",
"product_id": "bind-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.18.48-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-main@src",
"product": {
"name": "bind-main@src",
"product_id": "bind-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.18.48-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-main@x86_64",
"product": {
"name": "bind-main@x86_64",
"product_id": "bind-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind@9.18.48-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "bind-main@noarch",
"product": {
"name": "bind-main@noarch",
"product_id": "bind-main@noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/bind-doc@9.18.48-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-main@aarch64"
},
"product_reference": "bind-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-main@noarch as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-main@noarch"
},
"product_reference": "bind-main@noarch",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-main@src"
},
"product_reference": "bind-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bind-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:bind-main@x86_64"
},
"product_reference": "bind-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-8677",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2025-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2405830"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentially cause a denial of service (DoS) for legitimate DNS clients.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: Resource exhaustion via malformed DNSKEY handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is considered Important because it allows a remote, unauthenticated attacker to cause significant CPU exhaustion on vulnerable BIND resolvers by serving zones containing malformed DNSKEY records. The flaw triggers excessive computational effort during DNSKEY validation, leading to degraded performance and potential denial of service for legitimate clients. However, the issue affects availability only\u2014it does not enable code execution, data exposure, or privilege escalation\u2014so it is not classified as critical. Furthermore, authoritative servers are not impacted, limiting the scope of exposure to recursive resolvers. While the attack is easy to launch and can disrupt DNS operations, its effect ceases once the malicious traffic stops, making prompt patching and recursive access control effective mitigations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-8677"
},
{
"category": "external",
"summary": "RHBZ#2405830",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405830"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-8677",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-8677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8677"
}
],
"release_date": "2025-10-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nTo reduce risk, restrict recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: Resource exhaustion via malformed DNSKEY handling"
},
{
"cve": "CVE-2025-13878",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-01-21T13:45:49.972000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431600"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in bind. A remote attacker can send a specially crafted request that results in a corrupt or malicious record, causing the \u0027named\u0027 service to crash. This vulnerability leads to a Denial of Service (DoS) for authoritative servers and resolvers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of Service via corrupt or malicious record",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products as it affects the BIND DNS server (named). An attacker can cause the named service to crash by sending a specially crafted request, impacting both authoritative and resolver server configurations. This can lead to a denial of service for DNS resolution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13878"
},
{
"category": "external",
"summary": "RHBZ#2431600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13878",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13878"
}
],
"release_date": "2026-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of Service via corrupt or malicious record"
},
{
"cve": "CVE-2025-40778",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2025-10-22T15:07:23.729000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2405827"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability exists in BIND\u2019s DNS resolver logic that makes it overly permissive when accepting resource records (RRs) in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache, redirecting clients to malicious domains or unauthorized servers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: Cache poisoning attacks with unsolicited RRs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "It is classified as Important rather than Critical because its impact is limited to cache poisoning within recursive resolvers and does not allow direct code execution, privilege escalation, or service disruption. The vulnerability affects the accuracy of DNS responses, but not the availability or confidentiality of systems. Additionally, DNSSEC-enabled deployments and restricted recursive access can significantly mitigate exploitation risks. Therefore, while the flaw can misdirect network traffic and compromise trust in name resolution, it does not directly compromise the underlying server or client systems, justifying an Important \u2014 but not Critical \u2014 severity rating.\n\nTechnical Analysis:\nThe issue arises because BIND fails to strictly validate unsolicited resource records accompanying legitimate DNS responses. This gap allows forged recursive resolvers to be cached as valid entries. Since the attack is remote, requires no authentication, and exploits a low-complexity vector, it is highly impactful in recursive resolver environments\u2014especially those exposed to untrusted clients or open resolvers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-40778"
},
{
"category": "external",
"summary": "RHBZ#2405827",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405827"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-40778",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-40778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40778"
}
],
"release_date": "2025-10-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "While it is not possible to eliminate risk from this vulnerability, there are several options for reducing the risk. These include restricting recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: Cache poisoning attacks with unsolicited RRs"
},
{
"cve": "CVE-2025-40780",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2025-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2405829"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator (PRNG). This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS responses into the resolver\u2019s cache, causing clients to receive spoofed DNS data. Authoritative servers are generally unaffected, but recursive resolvers are exposed to this risk. Exploitation is remote and does not require user interaction.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: Cache poisoning due to weak PRNG",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in BIND 9 resolvers caused by a weakness in the Pseudo Random Number Generator (PRNG) used to select the UDP source port and DNS query (transaction) ID. Exploitation requires an attacker to correctly predict both values and race the legitimate authoritative response with a spoofed packet to perform cache poisoning. While the PRNG weakness reduces entropy and makes prediction feasible under certain conditions, this still requires precise timing, on-path or spoofing capabilities, and targeting of recursive resolvers.\n\nThe impact is limited to resolver cache integrity; it does not allow remote code execution, privilege escalation, or direct compromise of the BIND server itself. Authoritative servers are not affected. Additionally, operational mitigations such as DNSSEC validation, access control restricting recursion, and network-level packet filtering reduce real-world exploitability. No active exploits have been observed in the wild.\n\nBecause exploitation is non-trivial, requires network-level spoofing and precise timing, and only affects cache integrity without server compromise, the vulnerability is considered Important rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-40780"
},
{
"category": "external",
"summary": "RHBZ#2405829",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405829"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-40780",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40780"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-40780",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40780"
}
],
"release_date": "2025-10-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nTo reduce risk, restrict recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: Cache poisoning due to weak PRNG"
},
{
"cve": "CVE-2026-1519",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-25T14:01:56.586125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451305"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. A flaw in BIND allows a remote attacker to cause a Denial of Service by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. Red Hat systems running BIND configured for DNSSEC validation are affected. Authoritative-only BIND servers are generally not impacted unless configured to perform recursive queries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1519"
},
{
"category": "external",
"summary": "RHBZ#2451305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451305"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1519"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.18.47",
"url": "https://downloads.isc.org/isc/bind9/9.18.47"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.21",
"url": "https://downloads.isc.org/isc/bind9/9.20.21"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.20",
"url": "https://downloads.isc.org/isc/bind9/9.21.20"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-1519",
"url": "https://kb.isc.org/docs/cve-2026-1519"
}
],
"release_date": "2026-03-25T13:25:19.802000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DNSSEC validation on affected BIND resolvers. Alternatively, configure the BIND server as authoritative-only if recursive queries are not required. Disabling DNSSEC validation may reduce the security posture of the DNS resolver. A restart of the BIND service (`named`) is required for these changes to take effect and may temporarily interrupt DNS resolution.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone"
},
{
"cve": "CVE-2026-3104",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-25T14:02:15.067111+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451310"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the BIND resolver. A remote attacker can exploit this vulnerability by querying a specially crafted domain, which causes a memory leak. This memory leak can lead to a Denial of Service (DoS) condition, making the BIND resolver unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via specially crafted domain query causing a memory leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in BIND 9. A remote attacker can trigger a memory leak in the BIND resolver by sending a specially crafted domain query, potentially exhausting system resources. Red Hat Enterprise Linux versions shipping BIND 9.18 are not affected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3104"
},
{
"category": "external",
"summary": "RHBZ#2451310",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451310"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3104"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3104",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3104"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.21",
"url": "https://downloads.isc.org/isc/bind9/9.20.21"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.20",
"url": "https://downloads.isc.org/isc/bind9/9.21.20"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-3104",
"url": "https://kb.isc.org/docs/cve-2026-3104"
}
],
"release_date": "2026-03-25T13:29:19.494000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict access to the BIND resolver to trusted clients only. This can be achieved by configuring firewall rules to limit inbound connections to port 53 (UDP/TCP) from known, authorized IP addresses or networks. Alternatively, configure BIND to listen only on specific trusted interfaces or localhost.\n\nExample using firewalld:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_OR_NETWORK\u003e\" port port=53 protocol=\"udp\" accept\u0027`\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_OR_NETWORK\u003e\" port port=53 protocol=\"tcp\" accept\u0027`\n`firewall-cmd --reload`\n\nAfter applying changes, a restart of the BIND service may be required for the new configuration to take full effect. This may temporarily interrupt DNS resolution services.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via specially crafted domain query causing a memory leak"
},
{
"cve": "CVE-2026-3119",
"cwe": {
"id": "CWE-237",
"name": "Improper Handling of Structural Elements"
},
"discovery_date": "2026-03-25T14:02:07.297575+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451308"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via authenticated TKEY queries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. A flaw in BIND 9\u0027s `named` component can lead to a Denial of Service if an attacker with a valid Transaction Signature (TSIG) key sends a specially crafted query. Red Hat Enterprise Linux 8 and 9 are affected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3119"
},
{
"category": "external",
"summary": "RHBZ#2451308",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451308"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3119"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.21",
"url": "https://downloads.isc.org/isc/bind9/9.20.21"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.20",
"url": "https://downloads.isc.org/isc/bind9/9.21.20"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-3119",
"url": "https://kb.isc.org/docs/cve-2026-3119"
}
],
"release_date": "2026-03-25T13:31:54.806000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict access to the `named` service to only trusted networks and clients. If Transaction Signature (TSIG) keys are not actively used or required, consider disabling them in the BIND configuration. If TSIG keys are necessary, ensure they are securely managed and only distributed to authorized clients. After making configuration changes, a restart of the `named` service may be required to apply the changes, which could temporarily impact DNS resolution.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bind: BIND: Denial of Service via authenticated TKEY queries"
},
{
"cve": "CVE-2026-3591",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-25T14:01:21.633259+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451298"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND, specifically in the named server\u0027s handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Unauthorized access due to use-after-return vulnerability in DNS query handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has a Moderate impact. A use-after-return flaw in the `named` server of `bind9` allows a remote attacker to send a specially-crafted DNS request signed with SIG(0). This can lead to improper Access Control List (ACL) matching, potentially granting unauthorized access to resources. Red Hat Enterprise Linux 8 and 9 ship with BIND versions 9.16 and 9.18 respectively, which are not affected by this flaw. Red Hat Enterprise Linux 10 is affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3591"
},
{
"category": "external",
"summary": "RHBZ#2451298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3591"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.21",
"url": "https://downloads.isc.org/isc/bind9/9.20.21"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.20",
"url": "https://downloads.isc.org/isc/bind9/9.21.20"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-3591",
"url": "https://kb.isc.org/docs/cve-2026-3591"
}
],
"release_date": "2026-03-25T13:34:14.202000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T23:30:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6935"
},
{
"category": "workaround",
"details": "Restrict network access to the `named` service to trusted clients and networks. Configure firewall rules to limit inbound connections to the DNS service port (UDP/TCP 53). For example, using `firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_RANGE\u003e\" port port=\"53\" protocol=\"udp\" accept\u0027` and `firewall-cmd --reload`. This action may impact DNS resolution for clients outside the specified trusted networks. A service reload or restart may be required for changes to take effect.",
"product_ids": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:bind-main@aarch64",
"Red Hat Hardened Images:bind-main@noarch",
"Red Hat Hardened Images:bind-main@src",
"Red Hat Hardened Images:bind-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bind: BIND: Unauthorized access due to use-after-return vulnerability in DNS query handling"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…