The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0925 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-10723:
    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge     authenticated NXDOMAIN responses.
    This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11331:
    An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query     names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled     correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9     software.
    This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11622:
    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can     suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver     can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured     in the max-cache-size parameter.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11721:
    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of     labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a     zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to     have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13204:
    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13321:
    The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside     the signer's zone.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0     through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13204)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55441 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57189 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
341136	TencentOS Server 3: bind9.16 (TSSA-2026:0925)	Nessus	Tencent Local Security Checks	2026/8/27	2026/8/27	high
329451	Linux Distros Unpatched Vulnerability : CVE-2026-13204	Nessus	Misc.	2026/7/25	2026/9/1	high
335921	RHEL 9 : bind (RHSA-2026:55441)	Nessus	Red Hat Local Security Checks	2026/8/17	2026/8/17	high
338211	RHEL 9 : bind (RHSA-2026:57189)	Nessus	Red Hat Local Security Checks	2026/8/20	2026/8/20	high

检测

插件搜索

high

high

high

high