ELSA-2026-90328

ELSA-2026-90328 - bind security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-10-26

Description

[9.18.33-15.0.1.el10_2.13]
- Hard require needed openssl-libs [Orabug: 38742109]
- Fix warning when changing device file permissions [Orabug: 36518580]

[32:9.18.33-15.13]
- Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.

[32:9.18.33-15.12]
- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)
- Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563)
- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)
- Reject oversized negative cached records early (CVE-2026-19667)
- Set limit to following HTTPS/SVCB aliases (CVE-2026-81736)

[32:9.18.33-15.11]
- Add new root key 38696 into package files too (RHEL-252999)

[32:9.18.33-15.10]
- Validate NSEC3 signer matches owning zone (CVE-2026-10723)

[32:9.18.33-15.9]
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)

[32:9.18.33-15.7]
- Fix reference-counted dns_slabheaders in cache (CVE-2026-11622)

[32:9.18.33-15.6]
- Fix RRSIG label count validation for wildcard cache poisoning
(CVE-2026-11721)

[32:9.18.33-15.5]
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)

[32:9.18.33-15.4]
- Fix assertion failure on malformed NSEC/NSEC3 responses
(CVE-2026-13204)

Related CVEs

CVE-2026-19662

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	bind-9.18.33-15.0.1.el10_2.13.src.rpm	cf1f52cba4bb491a594f5444958dd0c57c67f5db6a209b8dd0533935421d1ca7	-	ol10_aarch64_appstream
	bind-9.18.33-15.0.1.el10_2.13.src.rpm	cf1f52cba4bb491a594f5444958dd0c57c67f5db6a209b8dd0533935421d1ca7	-	ol10_aarch64_codeready_builder
	bind-9.18.33-15.0.1.el10_2.13.aarch64.rpm	a900fc2645e6d50c551f5cac82634c7d1e1747886f99007f763a9dcd4b41f8ab	-	ol10_aarch64_appstream
	bind-chroot-9.18.33-15.0.1.el10_2.13.aarch64.rpm	fa96784a7a0f61277543897a50b33638f475bc55c1da4a236614001ce0c4c8d9	-	ol10_aarch64_appstream
	bind-devel-9.18.33-15.0.1.el10_2.13.aarch64.rpm	3c5f8feaaef493149f5160bd37a71a82bae4b5ebefebb8ae8774f5dfe3072a92	-	ol10_aarch64_codeready_builder
	bind-dnssec-utils-9.18.33-15.0.1.el10_2.13.aarch64.rpm	f5a5337e7a6828f75b4704344153615faef08445090086f1581f4e3ef1e64adc	-	ol10_aarch64_appstream
	bind-doc-9.18.33-15.0.1.el10_2.13.noarch.rpm	660e2d9c5ddf8df4ea4400e74bc8844aa9e03736f0815049844d5bfadf05a51f	-	ol10_aarch64_codeready_builder
	bind-libs-9.18.33-15.0.1.el10_2.13.aarch64.rpm	1911caa7b36930b5689c835c9395645293893befe4ac7ba06062bc1fc1ba0d0a	-	ol10_aarch64_appstream
	bind-license-9.18.33-15.0.1.el10_2.13.noarch.rpm	7c8e15bc41395884fca058b4512448d41128ca08104a0b41531b1aab70ebf6e1	-	ol10_aarch64_appstream
	bind-utils-9.18.33-15.0.1.el10_2.13.aarch64.rpm	5c82d7459509d31db6e58866b7c74e31b10d8760375eacef8b8c15d0087dda0c	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	bind-9.18.33-15.0.1.el10_2.13.src.rpm	cf1f52cba4bb491a594f5444958dd0c57c67f5db6a209b8dd0533935421d1ca7	-	ol10_x86_64_appstream
	bind-9.18.33-15.0.1.el10_2.13.src.rpm	cf1f52cba4bb491a594f5444958dd0c57c67f5db6a209b8dd0533935421d1ca7	-	ol10_x86_64_codeready_builder
	bind-9.18.33-15.0.1.el10_2.13.x86_64.rpm	550f1a65e99d04b8e2bf4ba68f14c335aaf53d4962458314e9622ff8805b2f05	-	ol10_x86_64_appstream
	bind-chroot-9.18.33-15.0.1.el10_2.13.x86_64.rpm	6ff09727fd6d0e2a826778b19a3a85754aa3bfcc4a06cbe491a2794ff5b4b45f	-	ol10_x86_64_appstream
	bind-devel-9.18.33-15.0.1.el10_2.13.x86_64.rpm	b177afc6e289c47c42cb8b6b1f03a1fc7fdb72750b05d89ab82a3340059420ac	-	ol10_x86_64_codeready_builder
	bind-dnssec-utils-9.18.33-15.0.1.el10_2.13.x86_64.rpm	b38e85685af6c9f67417c84ce87689fa359f784660e59afa85f7764b5fd5a335	-	ol10_x86_64_appstream
	bind-doc-9.18.33-15.0.1.el10_2.13.noarch.rpm	660e2d9c5ddf8df4ea4400e74bc8844aa9e03736f0815049844d5bfadf05a51f	-	ol10_x86_64_codeready_builder
	bind-libs-9.18.33-15.0.1.el10_2.13.x86_64.rpm	1b50367b565ae712e899d64ebf916a294538d0c71a232c4826e9746bf2dc58eb	-	ol10_x86_64_appstream
	bind-license-9.18.33-15.0.1.el10_2.13.noarch.rpm	7c8e15bc41395884fca058b4512448d41128ca08104a0b41531b1aab70ebf6e1	-	ol10_x86_64_appstream
	bind-utils-9.18.33-15.0.1.el10_2.13.x86_64.rpm	f22e170aaf963571bbce3af77d8dc3d4194b1ee99bafb7132d5f368523a13e8a	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team