The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of     a particular kind of invalid DNSSEC record. Default limits on max-records-per-type and max-types-per-     name help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0     through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19668)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8969-1 advisory.

    It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such     as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use     excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

    It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use     this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu     26.10. (CVE-2026-19662)

    It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could     possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This     issue only affected Ubuntu 26.10. (CVE-2026-19668)

    It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-19666)

    It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-76163)

    It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker     could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue     only affected Ubuntu 26.10. (CVE-2026-19033)

    It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could     possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue     only affected Ubuntu 26.10. (CVE-2026-19941)

    It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-77692)

    It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the     zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as     authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

    It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of     ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources,     leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

    It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote     attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned     answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

    It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-80274)

    It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could     possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected     Ubuntu 26.10. (CVE-2026-19667)

    It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote     attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial     of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

    It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS     messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory     resources, leading to a denial of service. (CVE-2026-19630)

    It was discovered that Bind incorrectly serialized access to shared GSS-TSIG security contexts. A remote     attacker could possibly use this issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)

    It was discovered that Bind incorrectly handled redirect zones when used together with strict QNAME     minimization. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2026-96888)

    It was discovered that Bind incorrectly handled certain RPZ configurations when processing queries with     and without recursion. A remote attacker could possibly use this issue to cause Bind to crash, resulting     in a denial of service. (CVE-2026-97313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-aba85b9a89 advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d47a436e71 advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793303963 advisory.

  - For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a     zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that     does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server.
    Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit     the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue     affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1     through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)

  - An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim     resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the     control of the attacker. If the auth responds with a particular sequence of crafted answers, and those     answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-     after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)

  - A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of     a particular kind of invalid DNSSEC record. Default limits on max-records-per-type and max-types-per-     name help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0     through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19668)

  - An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

  - In a query response, an attacker may send `named` multiple copies of a record that should only exist once     (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-     memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other     memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27,     9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory.

    Inbound-message resource exhaustion (CWE-400) leading to denial of service. No configuration precondition;
    version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50, 9.20.0-9.20.29,     9.21.0-9.21.26. (CVE-2026-19630)

    A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of     a particular kind of invalid DNSSEC record.  Default limits on max-records-per-type and max-types-per-     name help mitigate the exposure.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19668)

    A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading     a secure delegation and letting a forged unsigned answer through.This issue affects BIND 9 versions 9.11.0     through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and     9.20.9-S1 through 9.20.27-S1. (CVE-2026-77119)

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can     capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By     also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote     code execution. (CVE-2026-94300)

    Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization (CWE-617). A     resolver is only affected when configured with both a redirect zone AND qname-minimization strict.
    Affected versions: 9.16.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26. (CVE-2026-96888)

    Named exits on an assertion failure, resulting in denial of service. Affected versions: 9.16.0-9.18.50,     9.20.0-9.20.29. (CVE-2026-97313)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
346475	Linux Distros Unpatched Vulnerability : CVE-2026-19668	Nessus	Misc.	2026/9/16	2026/11/5	medium
375772	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Bind vulnerabilities (USN-8969-1)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/4	high
369375	Fedora 43 : bind / bind-dyndb-ldap (2026-aba85b9a89)	Nessus	Fedora Local Security Checks	2026/10/21	2026/10/21	high
370493	Fedora 43 : bind9-next (2026-d47a436e71)	Nessus	Fedora Local Security Checks	2026/10/22	2026/10/22	medium
373886	AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793303963)	Nessus	Alma Linux Local Security Checks	2026/10/29	2026/10/29	medium
371851	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/10/25	high

检测

插件搜索

medium

high

high

medium

medium

high