An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4865 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4865-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 27, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bind9     Version        : 1:9.18.49-1~deb12u3     CVE ID         : CVE-2026-19033 CVE-2026-19662 CVE-2026-19666 CVE-2026-19667                      CVE-2026-19941 CVE-2026-75029 CVE-2026-78301 CVE-2026-80274                      CVE-2026-81563 CVE-2026-81736

    Several vulnerabilities were discovered in BIND, a DNS server implementation,     which may result in denial of service or cache poisoning.

    For Debian 12 bookworm, these problems have been fixed in version     1:9.18.49-1~deb12u3.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-87d221ec8c advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d47a436e71 advisory.

    # Update to 9.21.26 (rhbz#2489832)

    ## Security Fixes:

    - Prevent excessive CPU use validating crafted DNSSEC responses. (CVE-2026-19668)
    - Require a TSIG on every message of incoming zone transfers. (CVE-2026-19033)
    - Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3 records. (CVE-2026-77119)
    - Prevent forged DNSSEC-validated NXDOMAIN responses. (CVE-2026-19941)
    - DNS64 with break-dnssec could cause an assertion failure. (CVE-2026-19666)
    - Reject oversized negative cache records. (CVE-2026-19667)
    - Prevent resolver crash with cached DNSSEC proofs. (CVE-2026-19662)
    - Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. (CVE-2026-75029)
    - Fix an unauthenticated crash on HTTPS using SIG(0). (CVE-2026-77692)
    - Cached HTTPS/SVCB aliases could exhaust resolver CPU. (CVE-2026-81736)
    - Prevent TKEY queries from terminating named without global options. (CVE-2026-76163)
    - Out-of-zone records in a zone database could be served as authoritative. (CVE-2026-78301)
    - Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs. (CVE-2026-80274)
    - Following HTTPS/SVCB aliases could leak resolver cache memory. (CVE-2026-81563)

    ## Feature Changes:

    - Reject oversized and malformed DNSKEY records up front.
    - Reject out-of-zone records in zone transfers and zone files.

    ## Removed Features:

    - Remove the RFC 1918 reverse-lookup leakage warning.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4772-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792590954 advisory.

  - An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

  - In a query response, an attacker may send `named` multiple copies of a record that should only exist once     (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-     memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other     memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27,     9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)

  - A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading     a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions     9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and     9.20.9-S1 through 9.20.27-S1. (CVE-2026-77119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-aba85b9a89 advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4608-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
    - CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
    - CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5b5298a84 advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-56974571ee advisory.

    # Security updates using git snapshot

    Release 9.18 is end-of-life upstream. Apply security fixes including medium CVEs from somehow maintained     git branch bind-9.18.

    - [CVE-2026-75029](https://kb.isc.org/docs/CVE-2026-75029) Discard repeated SOA, CNAME, and DNAME records     when parsing DNS messages
    - [CVE-2026-19666](https://kb.isc.org/docs/CVE-2026-19666) DNS64 with break-dnssec could cause an     assertion failure
    - [CVE-2026-19662](https://kb.isc.org/docs/CVE-2026-19662) Prevent resolver crash with cached DNSSEC     proofs
    - [CVE-2026-19941](https://kb.isc.org/docs/CVE-2026-19941) Prevent forged DNSSEC-validated NXDOMAIN     responses
    - [CVE-2026-78301](https://kb.isc.org/docs/CVE-2026-78301) Out-of-zone records in a zone database could be     served as authoritative
    - [CVE-2026-81563](https://kb.isc.org/docs/CVE-2026-81563) Following HTTPS/SVCB aliases could leak     resolver cache memory
    - [CVE-2026-80274](https://kb.isc.org/docs/CVE-2026-80274) Crash on wildcard answers carrying both NSEC     and NSEC3 proofs
    - [CVE-2026-19033](https://kb.isc.org/docs/CVE-2026-19033) Require a TSIG on every message of incoming     zone transfers
    - [CVE-2026-81736](https://kb.isc.org/docs/CVE-2026-81736) Cached HTTPS/SVCB aliases could exhaust     resolver CPU
    - [CVE-2026-19667](https://kb.isc.org/docs/CVE-2026-19667) Reject negative cache records that do not fit     in a dns_rdata_t



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8929-1 advisory.

    Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote     attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2025-8677)

    Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain     records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

    Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker     could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to     a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and     Ubuntu 20.04 LTS. (CVE-2026-1519)

    It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning     zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing     DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and     Ubuntu 20.04 LTS. (CVE-2026-10723)

    It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote     attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This     issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

    It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A     remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected     Ubuntu 20.04 LTS. (CVE-2026-11331)

    It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could     possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

    It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and     RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This     issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
    (CVE-2026-11721)

    It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC     and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to     cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

    It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC     validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

    It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on     multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone     contents to a secondary server. (CVE-2026-19033)

    It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use-     after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial     of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu     26.04 LTS. (CVE-2026-19662)

    It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A     remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
    (CVE-2026-19666)

    It was discovered that Bind incorrectly handled oversized negative answers when storing them in the     negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-19667)

    It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during     validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources,     leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668)

    It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard     existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the     existence of wildcard records. (CVE-2026-19941)

    It was discovered that Bind incorrectly handled repeated copies of records that should only appear once,     such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use     excessive memory, leading to a denial of service. (CVE-2026-75029)

    It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a     global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in     a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)

    It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an     insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and     inject forged unsigned answers. (CVE-2026-77119)

    It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records     when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind     to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692)

    It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An     attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in     cache poisoning. (CVE-2026-78301)

    It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the     same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a     denial of service. (CVE-2026-80274)

    It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode     records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a     denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-81563)

    It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode     records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources,     leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04     LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4664-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4635-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3995 advisory.

    For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a     zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that     does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server.
    Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit     the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue     affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1     through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)

    An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim     resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the     control of the attacker. If the auth responds with a particular sequence of crafted answers, and those     answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-     after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is     malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9     versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through     9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)

    An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

    In a query response, an attacker may send `named` multiple copies of a record that should only exist once     (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-     memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other     memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27,     9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)

    A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If     an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries     for names inside the configured zone then lose authoritative status and return an out-of-zone delegation.
    On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-     supplied data, affecting names outside the configured zone. This situation persists as long as the     malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50,     9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through     9.20.27-S1. (CVE-2026-78301)

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server     replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same     owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through     9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1     through 9.20.27-S1. (CVE-2026-80274)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 45921d77-b346-11f1-952f-589cfc023192 advisory.

    ISC team reports:
    CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching     CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets     CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path     CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add()     CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver     CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification     CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request     CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees     CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement     CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts     CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof     CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which
    could allow an attacker at the same or an upstream level of the zone name to mask the existence of a
    victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through
    9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3137 advisory.

    For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a     zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that     does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server.
    Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit     the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue     affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1     through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)

    An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim     resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the     control of the attacker. If the auth responds with a particular sequence of crafted answers, and those     answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-     after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)

    On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is     malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9     versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through     9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)

    If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes,     then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read,     `named` aborts.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0     through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)

    An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

    In a query response, an attacker may send `named` multiple copies of a record that should only exist once     (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-     memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other     memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27,     9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)

    A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If     an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries     for names inside the configured zone then lose authoritative status and return an out-of-zone delegation.
    On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-     supplied data, affecting names outside the configured zone. This situation persists as long as the     malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50,     9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through     9.20.27-S1. (CVE-2026-78301)

    If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server     replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same     owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through     9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1     through 9.20.27-S1. (CVE-2026-80274)

    A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode     records may fail to properly deallocate internal resources. If this happens repeatedly, resource     exhaustion will eventually prevent the resolver from performing new recursive lookups.This issue affects     BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through     9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81563)

    If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of     that tree, the resolver will spend disproportionate CPU time constructing the response.This issue affects     BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through     9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81736)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4285-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement       (bsc#1280439).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
    - CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
    - CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

    Changes for bind:

    Upgrade to release 9.20.29

     New Features:
     * Disclose active Negative Trust Anchors with Extended DNS Error      33.
     Feature Changes:
     * Reject oversized and malformed DNSKEY records up front.
     * Speed up RPZ policy zone updates.
     Bug Fixes:
     * Prevent a crash when using both dns64 and filter-a.
     * Stop passing UDP client addresses to update-policy external      helpers.
     * Missing required NSEC3 for delegation not detected.
     * Tighten EUI48 and EUI64 text parsing.
     * GeoIP ACL state could be stale or wrong after reload.
     * Honor DNSSEC policy key tag ranges.
     * Fix a double free in mdig when EDNS options are specified.
     * Fix a crash when an IXFR falls back to AXFR with updates still      pending.
     * Fix DS requests to parental agents over TLS.
     * Fix the rndc-confgen -q (quiet) option.
     * Enforce query ACLs for redirect zones and searched DLZs.
     * Check asnum validity in GeoIP ACLs.
     * Fix a crash on remote-servers lists that reference themselves.
     * A record from outside a response policy zone could crash named.
     * Invalid key-store configuration could abort the DNSSEC tools.
     * NSEC signature set could bypass the secure-delegation check.
     * Fix a possible nsupdate issue when using GSS-TSIG.
     * Fix a crash with a single-element geoip sortlist.
     * Prevent out-of-bailiwick CNAMEs from evicting cached records.
     * Restore periodic cleanup of stale resolver address data.
     * Fix named-checkconf/named crash with malformed key name.
     * Prevent resolver crashes while processing DNS over TCP.
     * Ensure NSEC authority does not cross zonecut boundary.
     * Treat an unusable NSEC3 chain as a verification failure.
     * Treat non-canonical RPZ prefixes as any other failure.
     * Negative caching stopped working with      stale-answer-client-timeout set to 0.
     * An unterminated OpenSSL private-key Label: field could be read      past its parser buffer.
     * Restore SMF support on Solaris and illumos.
     * Fix compilation on GNU/Hurd.
     * dig +yaml was producing invalid YAML when a lookup failed.
     * Properly prevent TSIG generation command line injection      attacks.
     * Fix a potential heap bounds overflow write in dnssec-signzone.
     * Fix crashes on invalid DNSTAP input in dnstap-read.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which     could allow an attacker at the same or an upstream level of the zone name to mask the existence of a     victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through     9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
    (CVE-2026-19941)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372660	Debian dla-4865 : bind9 - security update	Nessus	Debian Local Security Checks	Local	medium
371107	Fedora 44 : bind9-next (2026-87d221ec8c)	Nessus	Fedora Local Security Checks	Local	medium
370493	Fedora 43 : bind9-next (2026-d47a436e71)	Nessus	Fedora Local Security Checks	Local	medium
370388	SUSE SLES15 Security Update : bind (SUSE-SU-2026:4772-1)	Nessus	SuSE Local Security Checks	Local	medium
369965	AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792590954)	Nessus	Alma Linux Local Security Checks	Local	medium
369375	Fedora 43 : bind / bind-dyndb-ldap (2026-aba85b9a89)	Nessus	Fedora Local Security Checks	Local	high
369270	SUSE SLES15 Security Update : bind (SUSE-SU-2026:4608-1)	Nessus	SuSE Local Security Checks	Local	medium
367733	Fedora 44 : bind / bind-dyndb-ldap (2026-a5b5298a84)	Nessus	Fedora Local Security Checks	Local	high
367324	Fedora 46 : bind / bind-dyndb-ldap (2026-56974571ee)	Nessus	Fedora Local Security Checks	Local	high
367203	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8929-1)	Nessus	Ubuntu Local Security Checks	Local	high
366033	SUSE SLES15 Security Update : bind (SUSE-SU-2026:4664-1)	Nessus	SuSE Local Security Checks	Local	medium
365549	SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:4635-1)	Nessus	SuSE Local Security Checks	Local	medium
365245	Amazon Linux 2 : bind (ALAS-2026-3995)	Nessus	Amazon Linux Local Security Checks	Local	medium
362910	FreeBSD : bind920 -- multiple vulnerabilities (45921d77-b346-11f1-952f-589cfc023192)	Nessus	FreeBSD Local Security Checks	Local	medium
459988	Echo: bind9: security update to 1:9.20.29-1~deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459988	Echo: bind9: security update to 1:9.20.29-1~deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351047	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3137)	Nessus	Amazon Linux Local Security Checks	Local	medium
349183	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:4285-1)	Nessus	SuSE Local Security Checks	Local	medium
346472	Linux Distros Unpatched Vulnerability : CVE-2026-19941	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-19941

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium