← All notices | Source (USN-8648-1) | Text version

QSN-8648-1: Bind vulnerabilities

August 19, 2026

Summary

Several security issues were fixed in Bind.

Details

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331)

It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721)

It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.9.1.001Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.9.1.001Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.8.6.015Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.8.6.015Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.8.6.015Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.5Fixed in this release
6.8.5.018Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.5Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-11721, CVE-2026-11605, CVE-2026-10822, CVE-2026-12617, CVE-2026-10723, CVE-2026-13321, CVE-2026-11331, CVE-2026-11622

References

https://ubuntu.com/security/notices/USN-8648-1

https://nvd.nist.gov/vuln/detail/CVE-2026-11721

https://nvd.nist.gov/vuln/detail/CVE-2026-11605

https://nvd.nist.gov/vuln/detail/CVE-2026-10822

https://nvd.nist.gov/vuln/detail/CVE-2026-12617

https://nvd.nist.gov/vuln/detail/CVE-2026-10723

https://nvd.nist.gov/vuln/detail/CVE-2026-13321

https://nvd.nist.gov/vuln/detail/CVE-2026-11331

https://nvd.nist.gov/vuln/detail/CVE-2026-11622

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
Ubuntu 22.04 LTSbind91:9.18.39-0ubuntu0.22.04.5
Ubuntu 24.04 LTSbind91:9.18.39-0ubuntu0.24.04.6
resolutebind91:9.20.24-1ubuntu0.2