QSN-8648-1: Bind vulnerabilities
2026-08-19

Summary:
Several security issues were fixed in Bind.

Details:
It was discovered that Bind incorrectly accepted NSEC3 records whose signer
name did not match the owning zone. A remote attacker could possibly use
this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC
validation. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the
PRIVATEDNS algorithm. A remote attacker could possibly use this issue to
cause Bind to crash, resulting in a denial of service. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in
Response Policy Zones. A remote attacker could possibly use this issue to
bypass configured RPZ policies. (CVE-2026-11331)

It was discovered that Bind performed unnecessary validation of DNSSEC
signed records. A remote attacker could possibly use this issue to cause
Bind to use excessive resources, leading to a denial of service. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

It was discovered that Bind incorrectly tracked memory usage in the DNS
cache. A remote attacker could possibly use this issue to cause Bind to use
memory beyond configured limits, leading to a denial of service.
(CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records
with label count discrepancies and RRSIG validation. A remote attacker
could possibly use this issue to perform cache poisoning attacks.
(CVE-2026-11721)

It was discovered that Bind incorrectly handled certain CNAME and DNAME
record orderings in the resolver. A remote attacker could possibly use this
issue to cause Bind to crash, resulting in a denial of service.
(CVE-2026-12617)

It was discovered that Bind incorrectly validated out-of-zone NSEC next
owner names during DNSSEC validation. A remote attacker could possibly use
this issue to bypass DNSSEC validation. (CVE-2026-13321)

Affected QuantaStor releases:
  6.9.1.001 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.9.1.001 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.9.1.001 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.9.0.464 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.9.0.464 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.9.0.464 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.7 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.6.015 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.6 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.6.015 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.6 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.6.015 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.6 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.5.018 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.5.018 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.5.018 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.4.038 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.4.038 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.4.038 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.3.018 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.3.018 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.3.018 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.2.002 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.2.002 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.2.002 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.1.007 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.1.007 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.1.007 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.0.205 jammy: bind9-dnsutils 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.0.205 jammy: bind9-host 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)
  6.8.0.205 jammy: bind9-libs 1:9.18.39-0ubuntu0.22.04.4 (fixed in 1:9.18.39-0ubuntu0.22.04.5)

CVEs: CVE-2026-11721, CVE-2026-11605, CVE-2026-10822, CVE-2026-12617, CVE-2026-10723, CVE-2026-13321, CVE-2026-11331, CVE-2026-11622

References:
  https://ubuntu.com/security/notices/USN-8648-1