If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

fedora FEDORA-2026-aba85b9a89: bind-9.18.51^git20261003.d0a87358-2.fc43 bind-dyndb-ldap-11.11-15.fc43

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5b5298a84 advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-56974571ee advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8929-1 advisory.

    Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote     attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2025-8677)

    Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain     records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

    Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker     could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to     a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and     Ubuntu 20.04 LTS. (CVE-2026-1519)

    It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning     zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing     DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and     Ubuntu 20.04 LTS. (CVE-2026-10723)

    It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This     issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

    It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A     remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected     Ubuntu 20.04 LTS. (CVE-2026-11331)

    It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could     possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

    It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and     RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This     issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
    (CVE-2026-11721)

    It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC     and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to     cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

    It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC     validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

    It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on     multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone     contents to a secondary server. (CVE-2026-19033)

    It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-     after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial     of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu     26.04 LTS. (CVE-2026-19662)

    It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-19666)

    It was discovered that Bind incorrectly handled oversized negative answers when storing them in the     negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-19667)

    It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during     validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources,     leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668)

    It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard     existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the     existence of wildcard records. (CVE-2026-19941)

    It was discovered that Bind incorrectly handled repeated copies of records that should only appear once,     such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use     excessive memory, leading to a denial of service. (CVE-2026-75029)

    It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a     global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in     a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)

    It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an     insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and     inject forged unsigned answers. (CVE-2026-77119)

    It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records     when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind     to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692)

    It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An     attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in     cache poisoning. (CVE-2026-78301)

    It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the     same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2026-80274)

    It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode     records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a     denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-81563)

    It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode     records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources,     leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04     LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8648-1 advisory.

    It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning     zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing     DNSSEC validation. (CVE-2026-10723)

    It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-10822)

    It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A     remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331)

    It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker     could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

    It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could     possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of     service. (CVE-2026-11622)

    It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and     RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks.
    (CVE-2026-11721)

    It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver.
    A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-12617)

    It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC     validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data,
    and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY,
    etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly
    give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later
    needs to render that record to text, it will use the invalid length during processing, leading to a
    consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through
    9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-10822)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0adbf9c133 advisory.

    Fixes multiple CVEs, without a rebase to newer version

    - Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
    - Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
    - Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
    - Potential memory usage beyond configured limits (CVE-2026-11622)
    - Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
    - Incorrect acceptance of NSEC3 records (CVE-2026-10723)
    - Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
    - DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.6 / 17.5.1.10 / 21.1.0.3. It is, therefore, affected by a vulnerability as referenced in the K000163233 advisory.

    If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data,     and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY,     etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly     give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later     needs to render that record to text, it will use the invalid length during processing, leading to a     consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through     9.20.24-S1.(CVE-2026-10822)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-875d2a5154 advisory.

    Fixes multiple CVEs

    - Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
    - Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
    - Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
    - Potential memory usage beyond configured limits (CVE-2026-11622)
    - Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
    - Incorrect acceptance of NSEC3 records (CVE-2026-10723)
    - Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
    - DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d87e7f498a advisory.

    Fixes multiple CVEs

    - Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
    - Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
    - Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
    - Potential memory usage beyond configured limits (CVE-2026-11622)
    - Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
    - Incorrect acceptance of NSEC3 records (CVE-2026-10723)
    - Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
    - DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2040 advisory.

    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge     authenticated NXDOMAIN responses.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-10723)

    If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data,     and may subsequently abort and exit.

    BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a     PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the     actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record     to text, it will use the invalid length during processing, leading to a consistency check failing.This     issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-10822)

    An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query     names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled     correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9     software.This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through     9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11331)

    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can     suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver     can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured     in the `max-cache-size` parameter.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0     through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-11622)

    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of     labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a     zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to     have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the     default).This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through     9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11721)

    The issue is unexpected program termination based on ordering and/or specific content in responses to     queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record     below the DNAME to the resolver, and the authoritative server responds positively to the A query but     delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client     queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds     positively to the A query but delays the CNAME response and later responds with a self-referential CNAME,     the same failure may occur.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-12617)

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0     through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13204)

    The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside     the signer's zone.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24,     9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13321)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3452-1 advisory.

    - CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge     authenticated       NXDOMAIN responses for sibling zones (bsc#1271982).
    - CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm identifier length can     trigger a       consistency check failure (bsc#1271983).
    - CVE-2026-11331: handling NAMETOOLONG error conditions incorrectly during RPZ wildcard CNAME processing     can allow       bypassing RPZ rules or triggering process exits (bsc#1271984).
    - CVE-2026-11622: DNSSEC validating resolver under a random subdomain attack can suffer from runaway     memory usage       exceeding max-cache-size and affecting response rate (bsc#1271986).
    - CVE-2026-11721: RRSIG with fewer labels than its containing zone when synth-from-dnssec is enabled can     lead to       wildcard generation (bsc#1271987).
    - CVE-2026-12617: delayed or specific CNAME/DNAME query responses combined with positive A record     responses can trigger       an assertion failure (bsc#1271988).
    - CVE-2026-13204: validating a domain covered by both NSEC and NSEC3 with an RRSIG for only one type can     trigger an       assertion failure (bsc#1271989).
    - CVE-2026-13321: NSEC records with a `Next Domain Name` pointing outside the signer's zone can allow     cross-zone cache       poisoning and authenticated denial-of-service responses (bsc#1271990).

    - Update to release 9.18.50:

     * Remove ineffective TCP fallback after repeated UDP timeouts.
     * Fall back to TCP on receipt of a UDP response with a mismatched query ID.
     * Fix DNS64 owner case after DNAME restart.
     * Clear REDIRECT flag when it isn't needed.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21489-1 advisory.

    This update for bind fixes the following issues

    - Upgrade to release 9.20.26
    - CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: Unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3426-1 advisory.

    Upgrade to release 9.20.26.

    Security issues fixed:

    - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
    - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
    - CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
    - CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).

    Other updates and bugfixes:

    - Release 9.20.26:
      * Reclaim memory promptly when DNSSEC validations are canceled.
      * Removed Features:
        * Remove the secondary validator in query.c.
        * Remove ineffective TCP fallback after repeated UDP timeouts.
      * Feature Changes:
        * Fall back to TCP on receipt of a UDP response with a mismatched           query ID.
        * Limit the number of glue records cached from a referral.
        * Fix a resolver stall on a CNAME response to a DS query.
      * Bug Fixes:
        * Fix a bug in DNS UPDATE processing with inline-signing enabled.
        * Properly detect private records before copying.
        * Tighten referral DS acceptance.
        * Don't synthesize negative responses with pending NSEC.
        * Check that an NSEC signer is at or above the name to be           validated.
        * Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
        * Fix a deny-answer-aliases configuration bypass issue.
        * Reject external referrals from forwarders.
        * Fix a zone transfer over TLS (XoT) issue when using the           opportunistic TLS mode.
        * Unvalidated opt-out NSEC3 could be accepted in insecurity           proof.
        * Check wildcard signer and NOQNAME signer match.
        * Fix CNAME resolution failure caused by a cached SERVFAIL           response.
        * Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
        * Fix a bug in GeoIP2 string matching.
        * Fix DNS-over-HTTPS (DoH) quota configuration issue.
        * Truncated reply to a TSIG query no longer stalls the resolver.
        * Ignore updates removing DNSKEY RRset with class ANY.
        * Ignore 0-byte reads in the TCP read callback.
        * Only print per-zone glue stats when zone-statistics is set to           full.
        * CDS/CDNSKEY records were not removed when re-configuring the           server.
        * Fix a crash when querying an empty non-terminal in a wildcard           zone in RBTDB.
        * Stop reusing outgoing TCP connections the peer has already           closed.
        * Fix DNSSEC validation failures for names under an apex DNAME.
          * The resolver now removes other RRsets at the same name when             caching a CNAME.
        * Fix nxdomain-redirect combined with dns64.
        * Fix DNS64 owner case after DNAME restart.
        * Clear REDIRECT flag when it isn't needed.
        * Disable output escaping in bind9.xsl.
        * Fix crash on badly configured secondary signer.
        * Fix a possible crash on concurrent TKEY DELETE for the same           key.
        * Reject RRSIG records covering meta-types.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data,     and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY,     etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly     give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later     needs to render that record to text, it will use the invalid length during processing, leading to a     consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-10822)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6395 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6395-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11605                      CVE-2026-11622 CVE-2026-11721 CVE-2026-12617 CVE-2026-13204                      CVE-2026-13321

    Several vulnerabilities were discovered in BIND, a DNS server     implementation, which may result in bypass of DNSSEC validation, RPZ     policy bypass, cache poisoning or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.26-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
367733	Fedora 44 : bind / bind-dyndb-ldap (2026-a5b5298a84)	Nessus	Fedora Local Security Checks	Local	high
367324	Fedora 46 : bind / bind-dyndb-ldap (2026-56974571ee)	Nessus	Fedora Local Security Checks	Local	high
367203	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8929-1)	Nessus	Ubuntu Local Security Checks	Local	high
365383	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8648-1)	Nessus	Ubuntu Local Security Checks	Local	high
463570	Echo: bind9: security update to 1:9.20.26-1~deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463570	Echo: bind9: security update to 1:9.20.26-1~deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
344889	Fedora 45 : bind (2026-0adbf9c133)	Nessus	Fedora Local Security Checks	Local	high
343850	F5 Networks BIG-IP : BIND vulnerability (K000163233)	Nessus	F5 Networks Local Security Checks	Local	medium
341822	Fedora 43 : bind (2026-875d2a5154)	Nessus	Fedora Local Security Checks	Local	high
341815	Fedora 44 : bind (2026-d87e7f498a)	Nessus	Fedora Local Security Checks	Local	high
332053	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-2040)	Nessus	Amazon Linux Local Security Checks	Local	high
331849	SUSE SLES15 Security Update : bind (SUSE-SU-2026:3452-1)	Nessus	SuSE Local Security Checks	Local	high
331566	openSUSE 16: bind / bind-modules-bdbhpt / bind-modules-generic / etc (openSUSE-SU-2026:21489-1)	Nessus	SuSE Local Security Checks	Local	high
331433	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:3426-1)	Nessus	SuSE Local Security Checks	Local	high
329426	Linux Distros Unpatched Vulnerability : CVE-2026-10822	Nessus	Misc.	Local	medium
329075	Debian dsa-6395 : bind9 - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-10822

medium

Tenable Plugins

Coming Soon

high

high

high

high

medium

medium

high

medium

high

high

high

high

high

high

medium

high