[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ag2wpSF3iv7iKeRO@larwa.hq.kempniu.pl>
Date: Wed, 20 May 2026 15:01:25 +0200
From: Michał Kępień <michal@....org>
To: oss-security@...ts.openwall.com
Cc: security-officer@....org
Subject: ISC has disclosed six vulnerabilities in BIND 9 (CVE-2026-3039,
CVE-2026-3592, CVE-2026-3593, CVE-2026-5946, CVE-2026-5947, CVE-2026-5950)
On 20 May 2026, Internet Systems Consortium disclosed six vulnerabilities affecting our BIND 9 software:
- CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation https://kb.isc.org/docs/cve-2026-3039
- CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records https://kb.isc.org/docs/cve-2026-3592
- CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation https://kb.isc.org/docs/cve-2026-3593
- CVE-2026-5946: Invalid handling of CLASS != IN https://kb.isc.org/docs/cve-2026-5946
- CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior https://kb.isc.org/docs/cve-2026-5947
- CVE-2026-5950: Unbounded resend loop in BIND 9 resolver https://kb.isc.org/docs/cve-2026-5950
New versions of BIND 9 are available:
- https://downloads.isc.org/isc/bind9/9.18.49/
- https://downloads.isc.org/isc/bind9/9.20.23/
- https://downloads.isc.org/isc/bind9/9.21.22/
For more information and other release formats, consult the ISC software download page: https://www.isc.org/download/
With the public announcement of these vulnerabilities, the embargo period is ended and any updated software packages that have been prepared may be released.
--
Best regards,
Michał Kępień
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
