The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2779-1 advisory.

    - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
    - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
    - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities:

  - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead     to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13,     9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-8677)

  - In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it     is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects     BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through     9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
    (CVE-2025-40780)

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to     excessive memory consumption when receiving and processing maliciously-constructed packets. Typically     these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS     environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0     through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and     9.20.9-S1 through 9.20.22-S1. (CVE-2026-3039)

  - BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver     makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This     issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1. (CVE-2026-3592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.18.49 / 9.20.23. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-141-01 advisory.

    New bind packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to     excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically     these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS     environments.
    This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1.(CVE-2026-3039)

    Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not     Internet (`IN`) -- for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or     `NONE`) in the question section. Specially crafted requests reaching the affected code paths -- recursion,     dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record     types in non-`IN` data -- can cause assertion failures in `named`. This issue affects BIND 9 versions     9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1     through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.(CVE-2026-5946)

    BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim     resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.
    This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1.(CVE-2026-3592)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2026-3592 advisory.

  - BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver     makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This     issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1. (CVE-2026-3592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6285 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6285-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 20, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-3039 CVE-2026-3592 CVE-2026-5946                      CVE-2026-5950 CVE-2026-5947 CVE-2026-3593

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:9.18.49-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.23-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8293-1 advisory.

    Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote     attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of     service. (CVE-2026-3039)

    Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue records. A remote attacker could     possibly use this issue to use Bind in denial of service amplification attacks against other systems.
    (CVE-2026-3592)

    Naresh Kandula Parmar discovered that Bind incorrectly handled memory in the DNS-over-HTTPS     implementation. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service, or execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS.
    (CVE-2026-3593)

    It was discovered that Bind incorrectly handled DNS messages whose class was not IN. A remote attacker     could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-5946)

    Naoki Wakamatsu discovered that Bind incorrectly handled SIG(0) validation during a query flood. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This     issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-5947)

    Billy Baraja discovered that Bind had an unbounded resend loop in the resolver. A remote attacker could     possibly use this issue to cause Bind to use excessive resources, leading to a denial of service.
    (CVE-2026-5950)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2616-1 advisory.

    - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
    - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
    - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b626e83a45 advisory.

    # Update to 9.18.49 (rhbz#2480121)

    ## Security Fixes:

    - Limit resolver server list size. ([CVE-2026-3592](https://kb.isc.org/docs/cve-2026-3592))
    - Fix GSS-API resource leak. ([CVE-2026-3039](https://kb.isc.org/docs/cve-2026-3039))
    - Disable recursion, UPDATE, and NOTIFY for non-IN views.
    ([CVE-2026-5946](https://kb.isc.org/docs/cve-2026-5946))
    - Avoid unbounded recursion loop. ([CVE-2026-5950](https://kb.isc.org/docs/cve-2026-5950))
    - Fix outgoing zone transfers' quota issue.

    ## Feature Changes:

    - Fix CPU spikes and slow queries when cache approaches memory limit.

    ## Bug Fixes:

    - Fix named crash when processing SIG records in dynamic updates.
    - Fix rndc modzone behavior for a zone in named.conf.
    - Fix zone verification of NSEC3 signed zones.
    - Prevent a crash when using both dns64 and filter-aaaa.
    - Fixed an assertion failure when processing catalog zones.
    - Prevent malicious DNSSEC zones from exhausting validator CPU.
    - Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
    - Prevent crafted queries from degrading RRL performance.
    - Fix a bug in allow-query/allow-transfer catalog zone custom properties.
    - Fix a memory leak issue in catalog zones.
    - Fix suppressed missing-glue check in named-checkzone.
    - Reject record sets too large to serve in DNS.

    Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for-bind-9-18-49


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2673-1 advisory.

    Security issues:

    - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
    - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
    - CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
    - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
    - CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
    - CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).

    Non security issue:

    - bind test failed with version 9.20.21 (bsc#1263494).
    - Upgrade to release 9.20.23

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
325372	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:2779-1)	Nessus	SuSE Local Security Checks	2026/7/7	2026/8/24	high
343570	NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2026-0110)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/10	high
316056	Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2026-141-01)	Nessus	Slackware Local Security Checks	2026/5/21	2026/5/25	medium
339277	EulerOS Virtualization 2.13.1 : bind (EulerOS-SA-2026-3166)	Nessus	Huawei Local Security Checks	2026/8/25	2026/8/25	high
315682	ISC BIND 9.11.0 < 9.18.49 / 9.11.3-S1 < 9.18.49-S1 / 9.18.0 < 9.18.49 / 9.18.11-S1 < 9.18.49-S1 / 9.20.0 < 9.20.23 / 9.20.9-S1 < 9.20.23-S1 / 9.21.0 < 9.21.22 Vulnerability (cve-2026-3592)	Nessus	DNS	2026/5/20	2026/5/26	medium
315942	Debian dsa-6285 : bind9 - security update	Nessus	Debian Local Security Checks	2026/5/20	2026/5/25	critical
316496	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Bind vulnerabilities (USN-8293-1)	Nessus	Ubuntu Local Security Checks	2026/5/22	2026/5/22	critical
322923	SUSE SLES15 Security Update : bind (SUSE-SU-2026:2616-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
316799	Fedora 43 : bind / bind-dyndb-ldap (2026-b626e83a45)	Nessus	Fedora Local Security Checks	2026/5/26	2026/5/26	high
323884	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:2673-1)	Nessus	SuSE Local Security Checks	2026/6/30	2026/7/3	critical

检测

插件搜索

high

high

medium

high

medium

critical

critical

high

high

critical