Back Linuxsecurity

Fedora 43 BIND 9.21.22 Security Fixes for Multiple Issues 2026

Linuxsecurity •LinuxSecurity Advisories • June 15, 2026

Update to 9.21.22 (rhbz#2480122) Security Fixes: Limit resolver server list size. (CVE-2026-3592) Fix GSS-API resource leak. (CVE-2026-3039) Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Avoid unbounded recursion loop. (CVE-2026-5950) Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947) Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) Fix outgoing zone transfers' quota issue. Feature Changes: Fix CPU spikes and slow queries when cache approaches memory limit. Implement RFC 3645 Section 4.1.1 key expiry check in TKEY. Reduce memory footprint by actively returning unused memory to the OS. multiple bugfixes. Source: bind-9-21-22

* Fri Jun 5 2026 Petr Menšík - 32:9.21.22-2 - Switch downstream change to upstream for 32b mem check * Fri Jun 5 2026 Petr Menšík - 32:9.21.22-1 - Update to 9.21.22 (rhbz#2480122)

[ 1 ] Bug #2480122 - bind9- -9.21.22 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ec095a4675' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DNS Vulnerabilities in Fedora BIND 9.21.22 Require Immediate Attention Fedora has released important security updates for BIND 9.21.22, addressing multiple vulnerabilities including CVE-2026-3592, CVE-2026-3039, CVE-2026-5946, CVE-2026-5950, CVE-2026-5947, and CVE-2026-3593. These vulnerabilities can lead to issues such as resource leaks, unbounded recursion loops, and crashes under load. The updates are crucial for systems running Fedora 43 and 44, as they mitigate risks associated with DNS server operations. The vulnerabilities were published on May 20, 2026, with a proof of concept for CVE-2026-5950 released on June 14, 2026. Administrators are advised to apply the updates promptly to protect against potential exploitation. The updates can be installed using the 'dnf' package manager. The overall impact is significant, affecting many users of the Fedora operating system. 2 sources 72

Extracted Entities

Fedora 43 BIND 9.21.22 Security Fixes for Multiple Issues 2026

The full story

Extracted Entities

Companies (1)

CVEs (6)

CWE Weaknesses (1)