Home / mailings [USN-8929-1] Bind vulnerabilities
Posted on 14 October 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8929-1
October 14, 2026
bind9 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Bind.
Software Description:
- bind9: Internet Domain Name Server
Details:
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack. This issue
only affected Ubuntu 18.04 LTS. (CVE-2025-40778)
Samy Medjahed discovered that Bind incorrectly handled insecure delegation
validation. A remote attacker could possibly use this issue to cause
excessive NSEC3 iterations, consuming CPU resources, and leading to a
denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)
It was discovered that Bind incorrectly accepted NSEC3 records whose signer
name did not match the owning zone. A remote attacker could possibly use
this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC
validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)
It was discovered that Bind incorrectly handled Key Records using the
PRIVATEDNS algorithm. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2026-10822)
It was discovered that Bind incorrectly handled wildcard CNAME expansion in
Response Policy Zones. A remote attacker could possibly use this issue to
bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-11331)
It was discovered that Bind incorrectly tracked memory usage in the DNS
cache. A remote attacker could possibly use this issue to cause Bind to use
memory beyond configured limits, leading to a denial of service. This issue
only affected Ubuntu 20.04 LTS. (CVE-2026-11622)
It was discovered that Bind incorrectly handled signed wildcard records
with label count discrepancies and RRSIG validation. A remote attacker
could possibly use this issue to perform cache poisoning attacks. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 20.04 LTS. (CVE-2026-11721)
It was discovered that Bind incorrectly handled DNSSEC validation when a
domain was covered by both NSEC and NSEC3 records with only one type having
an RRSIG. A remote attacker could possibly use this issue to cause Bind to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13204)
It was discovered that Bind incorrectly validated out-of-zone NSEC next
owner names during DNSSEC validation. A remote attacker could possibly use
this issue to bypass DNSSEC validation. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-13321)
It was discovered that Bind incorrectly served zone transfer data before
verifying the TSIG signature on multi-message transfers. A remote attacker
could possibly use this issue to send unauthorized zone contents to a
secondary server. (CVE-2026-19033)
It was discovered that Bind incorrectly handled the lifetime of cached
DNSSEC proofs, leading to a use-after-free. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)
It was discovered that Bind incorrectly handled certain malformed answers
when configured to use DNS64. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service.
(CVE-2026-19666)
It was discovered that Bind incorrectly handled oversized negative answers
when storing them in the negative cache. A remote attacker could possibly
use this issue to cause Bind to crash, resulting in a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667)
It was discovered that Bind incorrectly handled large numbers of certain
invalid DNSSEC records during validation. A remote attacker could possibly
use this issue to cause Bind to use excessive resources, leading to a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-19668)
It was discovered that Bind incorrectly accepted inapplicable NSEC records
as proof that no wildcard existed. A remote attacker could possibly use
this issue to forge NXDOMAIN responses, masking the existence of wildcard
records. (CVE-2026-19941)
It was discovered that Bind incorrectly handled repeated copies of records
that should only appear once, such as SOA, CNAME, or DNAME records. A
remote attacker could possibly use this issue to cause Bind to use
excessive memory, leading to a denial of service. (CVE-2026-75029)
It was discovered that Bind incorrectly handled TKEY queries when the
configuration did not contain a global options block. A remote attacker
could possibly use this issue to cause Bind to crash, resulting in a denial
of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)
It was discovered that Bind incorrectly accepted NSEC3 records from
unrelated sibling zones as proof of an insecure delegation. A remote
attacker could possibly use this issue to bypass DNSSEC validation and
inject forged unsigned answers. (CVE-2026-77119)
It was discovered that Bind incorrectly handled DNS-over-HTTPS requests
containing invalid SIG(0) records when the connection was closed
prematurely. A remote attacker could possibly use this issue to cause Bind
to crash, resulting in a denial of service. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-77692)
It was discovered that Bind incorrectly treated NS or DNAME records above
the zone origin as zone cuts. An attacker could possibly use this issue to
cause Bind to serve or cache out-of-zone data, resulting in cache
poisoning. (CVE-2026-78301)
It was discovered that Bind incorrectly handled wildcard answers with both
NSEC3 and NSEC proofs at the same owner name. A remote attacker could
possibly use this issue to cause Bind to crash, resulting in a denial of
service. (CVE-2026-80274)
It was discovered that Bind incorrectly released resources when processing
SVCB and HTTPS AliasMode records. A remote attacker could possibly use this
issue to cause Bind to exhaust resources, leading to a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563)
It was discovered that Bind incorrectly limited additional processing for
cached SVCB and HTTPS AliasMode records. A remote attacker could possibly
use this issue to cause Bind to use excessive CPU resources, leading to a
denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
bind9 1:9.20.24-1ubuntu0.4
Ubuntu 24.04 LTS
bind9 1:9.18.39-0ubuntu0.24.04.8
Ubuntu 22.04 LTS
bind9 1:9.18.39-0ubuntu0.22.04.7
Ubuntu 20.04 LTS
bind9 1:9.18.30-0ubuntu0.20.04.2+esm3
Available with Ubuntu Pro
Ubuntu 18.04 LTS
bind9 1:9.11.3+dfsg-1ubuntu1.19+esm6
Available with Ubuntu Pro
Ubuntu 16.04 LTS
bind9 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Available with Ubuntu Pro
Ubuntu 14.04 LTS
bind9 1:9.9.5.dfsg-3ubuntu0.19+esm15
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8929-1
CVE-2025-40778, CVE-2025-8677, CVE-2026-10723, CVE-2026-10822,
CVE-2026-11331, CVE-2026-11622, CVE-2026-11721, CVE-2026-13204,
CVE-2026-13321, CVE-2026-1519, CVE-2026-19033, CVE-2026-19662,
CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941,
CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692,
CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736
Package Information:
https://launchpad.net/ubuntu/+source/bind9/1:9.20.24-1ubuntu0.4
https://launchpad.net/ubuntu/+source/bind9/1:9.18.39-0ubuntu0.24.04.8
https://launchpad.net/ubuntu/+source/bind9/1:9.18.39-0ubuntu0.22.04.7
--===============8188107699228042246==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
