← All notices | Source (USN-8929-1) | Text version

QSN-8929-1: Bind vulnerabilities

October 14, 2026

Summary

Several security issues were fixed in Bind.

Details

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677)

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-11721)

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033)

It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-19666)

It was discovered that Bind incorrectly handled oversized negative answers when storing them in the negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667)

It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668)

It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the existence of wildcard records. (CVE-2026-19941)

It was discovered that Bind incorrectly handled repeated copies of records that should only appear once, such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. (CVE-2026-75029)

It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)

It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and inject forged unsigned answers. (CVE-2026-77119)

It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692)

It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in cache poisoning. (CVE-2026-78301)

It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-80274)

It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563)

It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.9.1.001Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.9.1.001Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.9.0.464Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.71:9.18.39-0ubuntu0.22.04.7Fixed in this release
6.8.6.015Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.61:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-dnsutilsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-hostInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSbind9-libsInternally-facing1:9.18.39-0ubuntu0.22.04.41:9.18.39-0ubuntu0.22.04.7Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-19033, CVE-2026-81736, CVE-2026-13321, CVE-2026-78301, CVE-2026-19941, CVE-2026-13204, CVE-2026-19668, CVE-2026-80274, CVE-2026-77692, CVE-2026-76163, CVE-2026-77119, CVE-2026-75029, CVE-2026-10723, CVE-2026-11622, CVE-2026-19666, CVE-2026-10822, CVE-2025-8677, CVE-2026-19667, CVE-2026-19662, CVE-2025-40778, CVE-2026-11721, CVE-2026-11331, CVE-2026-81563, CVE-2026-1519

References

https://ubuntu.com/security/notices/USN-8929-1

https://nvd.nist.gov/vuln/detail/CVE-2026-19033

https://nvd.nist.gov/vuln/detail/CVE-2026-81736

https://nvd.nist.gov/vuln/detail/CVE-2026-13321

https://nvd.nist.gov/vuln/detail/CVE-2026-78301

https://nvd.nist.gov/vuln/detail/CVE-2026-19941

https://nvd.nist.gov/vuln/detail/CVE-2026-13204

https://nvd.nist.gov/vuln/detail/CVE-2026-19668

https://nvd.nist.gov/vuln/detail/CVE-2026-80274

https://nvd.nist.gov/vuln/detail/CVE-2026-77692

https://nvd.nist.gov/vuln/detail/CVE-2026-76163

https://nvd.nist.gov/vuln/detail/CVE-2026-77119

https://nvd.nist.gov/vuln/detail/CVE-2026-75029

https://nvd.nist.gov/vuln/detail/CVE-2026-10723

https://nvd.nist.gov/vuln/detail/CVE-2026-11622

https://nvd.nist.gov/vuln/detail/CVE-2026-19666

https://nvd.nist.gov/vuln/detail/CVE-2026-10822

https://nvd.nist.gov/vuln/detail/CVE-2025-8677

https://nvd.nist.gov/vuln/detail/CVE-2026-19667

https://nvd.nist.gov/vuln/detail/CVE-2026-19662

https://nvd.nist.gov/vuln/detail/CVE-2025-40778

https://nvd.nist.gov/vuln/detail/CVE-2026-11721

https://nvd.nist.gov/vuln/detail/CVE-2026-11331

https://nvd.nist.gov/vuln/detail/CVE-2026-81563

https://nvd.nist.gov/vuln/detail/CVE-2026-1519

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicbind91:9.11.3+dfsg-1ubuntu1.19+esm6
Ubuntu 20.04 LTSbind91:9.18.30-0ubuntu0.20.04.2+esm3
Ubuntu 22.04 LTSbind91:9.18.39-0ubuntu0.22.04.7
Ubuntu 24.04 LTSbind91:9.18.39-0ubuntu0.24.04.8
resolutebind91:9.20.24-1ubuntu0.4
trustybind91:9.9.5.dfsg-3ubuntu0.19+esm15
xenialbind91:9.10.3.dfsg.P4-8ubuntu1.19+esm11