The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57189 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to     excessive memory consumption when receiving and processing maliciously-constructed packets.  Typically     these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS     environments.
    This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1.(CVE-2026-3039)

    Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not     Internet (`IN`) - for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or     `NONE`) in the question section. Specially crafted requests reaching the affected code paths - recursion,     dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record     types in non-`IN` data - can cause assertion failures in `named`.
    This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1.(CVE-2026-5946)

    BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.  If a victim     resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.
    This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1.(CVE-2026-3592)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_24367 advisory.

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1375 advisory.

    This advisory aggregates security fixes for the bind SRPM in CIQ LTS 9.6. It addresses 6 CVEs:
    CVE-2025-40780, CVE-2025-8677, CVE-2026-5950, CVE-2026-3592, CVE-2026-3039, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1377 advisory.

    This advisory aggregates security fixes for the bind SRPM in CIQ LTS 9.2. It addresses 6 CVEs:
    CVE-2025-40780, CVE-2025-8677, CVE-2026-5950, CVE-2026-3592, CVE-2026-3039, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2617-1 advisory.

    - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
    - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
    - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2779-1 advisory.

    - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
    - CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
    - CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities:

  - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead     to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13,     9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-8677)

  - In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it     is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects     BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through     9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
    (CVE-2025-40780)

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to     excessive memory consumption when receiving and processing maliciously-constructed packets. Typically     these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS     environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0     through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and     9.20.9-S1 through 9.20.22-S1. (CVE-2026-3039)

  - BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver     makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This     issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1. (CVE-2026-3592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1780475528 advisory.

  - BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to     excessive memory consumption when receiving and processing maliciously-constructed packets. Typically     these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS     environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0     through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and     9.20.9-S1 through 9.20.22-S1. (CVE-2026-3039)

  - BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver     makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This     issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22,     9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through     9.20.22-S1. (CVE-2026-3592)

  - Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not     Internet (`IN`)  for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or     `NONE`) in the question section. Specially crafted requests reaching the affected code paths  recursion,     dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record     types in non-`IN` data  can cause assertion failures in `named`. This issue affects BIND 9 versions     9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1     through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. (CVE-2026-5946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79160 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    Bug Fix(es) and Enhancement(s):

    * bind9.16: New root trust anchor key for DNSSEC (JIRA:RHEL-272314)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
338211	RHEL 9 : bind (RHSA-2026:57189)	Nessus	Red Hat Local Security Checks	2026/8/20	2026/8/20	high
348016	EulerOS Virtualization 2.12.1 : bind (EulerOS-SA-2026-3576)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high
357834	Rocky Linux 9 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2026_24367)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
355708	Rocky Linux 9.6 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (ciqsa-2026_1375)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
355718	Rocky Linux 9.2 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (ciqsa-2026_1377)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
322929	SUSE SLES15 Security Update : bind (SUSE-SU-2026:2617-1)	Nessus	SuSE Local Security Checks	2026/6/26	2026/6/26	high
325372	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:2779-1)	Nessus	SuSE Local Security Checks	2026/7/7	2026/8/24	high
343570	NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2026-0110)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/10	high
351779	CentOS Linux 8 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1780475528)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
364313	RHEL 8 : bind9.16 (RHSA-2026:79160)	Nessus	Red Hat Local Security Checks	2026/10/9	2026/10/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high