The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79113 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling     (CVE-2026-19667)

    * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)

    * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666)

    Bug Fix(es) and Enhancement(s):

    * bind 9.16 crash with SIGSEGV (JIRA:RHEL-273294)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4635-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4772-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-57cc6eadd3 advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bindutils package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes,     then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read,     `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0     through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8969-1 advisory.

    It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such     as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use     excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

    It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use     this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu     26.10. (CVE-2026-19662)

    It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could     possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This     issue only affected Ubuntu 26.10. (CVE-2026-19668)

    It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-19666)

    It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-76163)

    It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker     could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue     only affected Ubuntu 26.10. (CVE-2026-19033)

    It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could     possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue     only affected Ubuntu 26.10. (CVE-2026-19941)

    It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-77692)

    It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the     zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as     authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

    It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of     ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources,     leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

    It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote     attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned     answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

    It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    This issue only affected Ubuntu 26.10. (CVE-2026-80274)

    It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could     possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected     Ubuntu 26.10. (CVE-2026-19667)

    It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote     attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial     of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

    It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS     messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory     resources, leading to a denial of service. (CVE-2026-19630)

    It was discovered that Bind incorrectly serialized access to shared GSS-TSIG security contexts. A remote     attacker could possibly use this issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)

    It was discovered that Bind incorrectly handled redirect zones when used together with strict QNAME     minimization. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2026-96888)

    It was discovered that Bind incorrectly handled certain RPZ configurations when processing queries with     and without recursion. A remote attacker could possibly use this issue to cause Bind to crash, resulting     in a denial of service. (CVE-2026-97313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
369295	RHEL 8 : bind9.16 (RHSA-2026:79113)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/21	high
365549	SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:4635-1)	Nessus	SuSE Local Security Checks	2026/10/14	2026/10/14	medium
370388	SUSE SLES15 Security Update : bind (SUSE-SU-2026:4772-1)	Nessus	SuSE Local Security Checks	2026/10/22	2026/10/22	medium
374632	Fedora 45 : bind9-next (2026-57cc6eadd3)	Nessus	Fedora Local Security Checks	2026/10/31	2026/10/31	medium
375116	Photon OS 5.0: Bindutils PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	medium
374995	Photon OS 5.0: Bindutils PHSA-2026-5.0-90-1030	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high
346474	Linux Distros Unpatched Vulnerability : CVE-2026-19667	Nessus	Misc.	2026/9/16	2026/11/6	high
375772	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Bind vulnerabilities (USN-8969-1)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/4	high

检测

插件搜索

high

medium

medium

medium

medium

high

high

high