Detections
Analytics
Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3137)
medium Nessus Plugin ID 351047
Synopsis
The remote Amazon Linux 2023 host is missing a security update.Description
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3137 advisory.For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server.
Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use- after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
(CVE-2026-19941)
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in- memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation.
On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker- supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-78301)
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-80274)
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81563)
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81736)
Tenable has extracted the preceding description block directly from the tested product security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Run 'dnf update bind --releasever 2023.12.20260928' or or 'dnf update --advisory ALAS2023-2026-3137 --releasever 2023.12.20260928' to update your system.See Also
https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3137.html
https://alas.aws.amazon.com/faqs.html
https://explore.alas.aws.amazon.com/CVE-2026-19033.html
https://explore.alas.aws.amazon.com/CVE-2026-19662.html
https://explore.alas.aws.amazon.com/CVE-2026-19666.html
https://explore.alas.aws.amazon.com/CVE-2026-19667.html
https://explore.alas.aws.amazon.com/CVE-2026-19941.html
https://explore.alas.aws.amazon.com/CVE-2026-75029.html
https://explore.alas.aws.amazon.com/CVE-2026-78301.html
https://explore.alas.aws.amazon.com/CVE-2026-80274.html
Plugin Details
Severity: Medium
ID: 351047
File Name: al2023_ALAS2023-2026-3137.nasl
Version: 1.1
Type: Local
Agent: unix
Published: 9/29/2026
Updated: 9/29/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.2
Percentile: 96.33
CVSS v2
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:P
CVSS Score Source: CVE-2026-19033
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bind-chroot, p-cpe:/a:amazon:linux:bind-debuginfo, p-cpe:/a:amazon:linux:bind-debugsource, p-cpe:/a:amazon:linux:bind-devel, p-cpe:/a:amazon:linux:bind-dnssec-utils-debuginfo, p-cpe:/a:amazon:linux:bind-dnssec-utils, p-cpe:/a:amazon:linux:bind-doc, p-cpe:/a:amazon:linux:bind-libs-debuginfo, p-cpe:/a:amazon:linux:bind-libs, p-cpe:/a:amazon:linux:bind-license, p-cpe:/a:amazon:linux:bind-utils-debuginfo, p-cpe:/a:amazon:linux:bind-utils, p-cpe:/a:amazon:linux:bind
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 9/29/2026
Vulnerability Publication Date: 9/16/2026
Reference Information
CVE: CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19941, CVE-2026-75029, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736
IAVA: 2026-A-1029