Internet Systems Consortium BIND: Mehrere Schwachstellen
WID-SEC-2026-1626 · first 21.05.2026 · updated 12.10.2026 · CVSS 7,5
What it is about
BIND (Berkeley Internet Name Domain) ist ein Open-Source-Softwarepaket, das einen Domain-Name-System-Server implementiert. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um eine Speicherbeschädigung auszulösen oder einen Denial-of-Service-Zustand zu verursachen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- eine Speicherbeschädigung auszulösen oder einen Denial-of-Service-Zustand zu verursachen
Am I affected?
Affected according to the BSI:
- IBM AIX 7.3
- IBM VIOS 4.1
- Dell NetWorker
- Debian Linux
- Amazon Linux 2
- IBM AIX 7.2
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- Oracle Linux
- Infoblox NIOS
and 12 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Internet Systems Consortium BIND 9.18.49
- Internet Systems Consortium BIND 9.20.23
- Internet Systems Consortium BIND 9.21.22
- IBM i SJ10866
- IBM i SJ10925
- IBM i SJ10979
- IBM i SJ10988
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- SUSE Security Update SUSE-SU-2026:2673-1 vom 2026-06-29 lists.suse.com
- SUSE Security Update SUSE-SU-2026:2676-1 vom 2026-06-29 lists.suse.com
- openSUSE Security Update OPENSUSE-SU-2026:21123-1 vom 2026-06-30 lists.opensuse.org
- Bind Version 9.18.49 vom 2026-05-20 downloads.isc.org
- Bind Version 9.20.23 vom 2026-05-20 downloads.isc.org
- Bind Version 9.21.22 vom 2026-05-20 downloads.isc.org
- ISC Vulnerability CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation vom 2026-05-20 kb.isc.org
- ISC Vulnerability CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records vom 2026-05-20 kb.isc.org
- ISC Vulnerability CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation vom 2026-05-20 kb.isc.org
- ISC Vulnerability CVE-2026-5946: Invalid handling of CLASS != IN vom 2026-05-20 kb.isc.org
- ISC Vulnerability CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior vom 2026-05-20 kb.isc.org
- ISC Vulnerability CVE-2026-5950: Unbounded resend loop in BIND 9 resolver vom 2026-05-20 kb.isc.org
- Infoblox Advisory 5950 vom 2026-05-21 support.infoblox.com
- Debian Security Advisory DSA-6285 vom 2026-05-21 lists.debian.org
- Ubuntu Security Notice USN-8293-1 vom 2026-05-21 ubuntu.com
- Fedora Security Advisory FEDORA-2026-411248C8D9 vom 2026-05-21 bodhi.fedoraproject.org
- Red Hat Security Advisory RHSA-2026:7412 vom 2026-05-21 access.redhat.com
- Fedora Security Advisory FEDORA-2026-B626E83A45 vom 2026-05-21 bodhi.fedoraproject.org
- Red Hat Security Advisory RHSA-2026:20334 vom 2026-05-22 access.redhat.com
- Fedora Security Advisory FEDORA-2026-F3E466EA26 vom 2026-05-25 bodhi.fedoraproject.org
- openSUSE Security Update OPENSUSE-SU-2026:10874-1 vom 2026-05-29 lists.opensuse.org
- Oracle Linux Security Advisory ELSA-2026-23360 vom 2026-06-05 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:23360 vom 2026-06-04 access.redhat.com
- openSUSE Security Update OPENSUSE-SU-2026:10915-1 vom 2026-06-03 lists.opensuse.org
- Fedora Security Advisory FEDORA-2026-DBB0776AC5 vom 2026-06-05 bodhi.fedoraproject.org
and 42 more sources in the original advisory
CVE: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950, CVE-2026-3593, CVE-2026-5947
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.