The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d47a436e71 advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793303963 advisory.

  - For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a     zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that     does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server.
    Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit     the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue     affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1     through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)

  - An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim     resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the     control of the attacker. If the auth responds with a particular sequence of crafted answers, and those     answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-     after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)

  - A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of     a particular kind of invalid DNSSEC record. Default limits on max-records-per-type and max-types-per-     name help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0     through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19668)

  - An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

  - In a query response, an attacker may send `named` multiple copies of a record that should only exist once     (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-     memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other     memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27,     9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory.

    Inbound-message resource exhaustion (CWE-400) leading to denial of service. No configuration precondition;
    version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50, 9.20.0-9.20.29,     9.21.0-9.21.26. (CVE-2026-19630)

    A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of     a particular kind of invalid DNSSEC record.  Default limits on max-records-per-type and max-types-per-     name help mitigate the exposure.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19668)

    A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading     a secure delegation and letting a forged unsigned answer through.This issue affects BIND 9 versions 9.11.0     through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and     9.20.9-S1 through 9.20.27-S1. (CVE-2026-77119)

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can     capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By     also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote     code execution. (CVE-2026-94300)

    Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization (CWE-617). A     resolver is only affected when configured with both a redirect zone AND qname-minimization strict.
    Affected versions: 9.16.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26. (CVE-2026-96888)

    Named exits on an assertion failure, resulting in denial of service. Affected versions: 9.16.0-9.18.50,     9.20.0-9.20.29. (CVE-2026-97313)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6505 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6505-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 17, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-19033 CVE-2026-19662 CVE-2026-19666 CVE-2026-19667                      CVE-2026-19668 CVE-2026-75029 CVE-2026-76163 CVE-2026-77119                      CVE-2026-77692 CVE-2026-80274 CVE-2026-81563 CVE-2026-81736

    Several vulnerabilities were discovered in BIND, a DNS server implementation,     which may result in denial of service or cache poisoning.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.29-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4285-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement       (bsc#1280439).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
    - CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
    - CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

    Changes for bind:

    Upgrade to release 9.20.29

     New Features:
     * Disclose active Negative Trust Anchors with Extended DNS Error      33.
     Feature Changes:
     * Reject oversized and malformed DNSKEY records up front.
     * Speed up RPZ policy zone updates.
     Bug Fixes:
     * Prevent a crash when using both dns64 and filter-a.
     * Stop passing UDP client addresses to update-policy external      helpers.
     * Missing required NSEC3 for delegation not detected.
     * Tighten EUI48 and EUI64 text parsing.
     * GeoIP ACL state could be stale or wrong after reload.
     * Honor DNSSEC policy key tag ranges.
     * Fix a double free in mdig when EDNS options are specified.
     * Fix a crash when an IXFR falls back to AXFR with updates still      pending.
     * Fix DS requests to parental agents over TLS.
     * Fix the rndc-confgen -q (quiet) option.
     * Enforce query ACLs for redirect zones and searched DLZs.
     * Check asnum validity in GeoIP ACLs.
     * Fix a crash on remote-servers lists that reference themselves.
     * A record from outside a response policy zone could crash named.
     * Invalid key-store configuration could abort the DNSSEC tools.
     * NSEC signature set could bypass the secure-delegation check.
     * Fix a possible nsupdate issue when using GSS-TSIG.
     * Fix a crash with a single-element geoip sortlist.
     * Prevent out-of-bailiwick CNAMEs from evicting cached records.
     * Restore periodic cleanup of stale resolver address data.
     * Fix named-checkconf/named crash with malformed key name.
     * Prevent resolver crashes while processing DNS over TCP.
     * Ensure NSEC authority does not cross zonecut boundary.
     * Treat an unusable NSEC3 chain as a verification failure.
     * Treat non-canonical RPZ prefixes as any other failure.
     * Negative caching stopped working with      stale-answer-client-timeout set to 0.
     * An unterminated OpenSSL private-key Label: field could be read      past its parser buffer.
     * Restore SMF support on Solaris and illumos.
     * Fix compilation on GNU/Hurd.
     * dig +yaml was producing invalid YAML when a lookup failed.
     * Properly prevent TSIG generation command line injection      attacks.
     * Fix a potential heap bounds overflow write in dnssec-signzone.
     * Fix crashes on invalid DNSTAP input in dnstap-read.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4772-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-57cc6eadd3 advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8969-1 advisory.

    It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such     as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use     excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

    It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use     this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu     26.10. (CVE-2026-19662)

    It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could     possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This     issue only affected Ubuntu 26.10. (CVE-2026-19668)

    It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-19666)

    It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-76163)

    It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker     could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue     only affected Ubuntu 26.10. (CVE-2026-19033)

    It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could     possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue     only affected Ubuntu 26.10. (CVE-2026-19941)

    It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-77692)

    It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the     zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as     authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

    It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of     ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources,     leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

    It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote     attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned     answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

    It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-80274)

    It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could     possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected     Ubuntu 26.10. (CVE-2026-19667)

    It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote     attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial     of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

    It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS     messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory     resources, leading to a denial of service. (CVE-2026-19630)

    It was discovered that Bind incorrectly serialized access to shared GSS-TSIG security contexts. A remote     attacker could possibly use this issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)

    It was discovered that Bind incorrectly handled redirect zones when used together with strict QNAME     minimization. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2026-96888)

    It was discovered that Bind incorrectly handled certain RPZ configurations when processing queries with     and without recursion. A remote attacker could possibly use this issue to cause Bind to crash, resulting     in a denial of service. (CVE-2026-97313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ISC BIND running on the remote host is 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by multiple vulnerabilities :

  - If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server     replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner     name, it will trigger an unexpected program exit. (CVE-2026-80274)

  - A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a     secure delegation and letting a forged unsigned answer through. (CVE-2026-77119)

  - A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an     attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for     names inside the configured zone then lose authoritative status and return an out-of-zone delegation.
    (CVE-2026-78301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
370493	Fedora 43 : bind9-next (2026-d47a436e71)	Nessus	Fedora Local Security Checks	2026/10/22	2026/10/22	medium
373886	AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793303963)	Nessus	Alma Linux Local Security Checks	2026/10/29	2026/10/29	medium
371851	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/10/25	high
346980	Debian dsa-6505 : bind9 - security update	Nessus	Debian Local Security Checks	2026/9/17	2026/9/17	medium
349183	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:4285-1)	Nessus	SuSE Local Security Checks	2026/9/23	2026/9/23	medium
370388	SUSE SLES15 Security Update : bind (SUSE-SU-2026:4772-1)	Nessus	SuSE Local Security Checks	2026/10/22	2026/10/22	medium
374632	Fedora 45 : bind9-next (2026-57cc6eadd3)	Nessus	Fedora Local Security Checks	2026/10/31	2026/10/31	medium
375116	Photon OS 5.0: Bindutils PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	medium
375772	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Bind vulnerabilities (USN-8969-1)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/4	high
347969	ISC BIND 9.11.0 < 9.20.29 / 9.11.3-S1 < 9.20.29-S1 / 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 Multiple Vulnerabilities	Nessus	DNS	2026/9/18	2026/9/21	medium

检测

插件搜索

medium

medium

high

medium

medium

medium

medium

medium

high

medium