Back Linuxsecurity

Fedora 43 bind9-next Critical DNS Fix CVE-2026-1519 DoS 2026

Linuxsecurity •LinuxSecurity Advisories • April 3, 2026

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Update Information : Update to 9.21.20 (rhbz#2440560) Security Fixes: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: Provide response round-trip time (RTT) counters via statistics channel. Introduce max-delegation-servers configuration option. Bug Fixes: Fix parsing key inactivation time in KASP code. Fix the handling of key statements defined inside views. Update to 9.21.19 Security Fixes: Fix a use-after-free error in dns_client_resolve() triggered by a DNAME response. Fix a NULL pointer dereference in qp-trie cache code. Immediately remove purged ADB names and entries from the SIEVE list. Feature Changes: Record query time for all dnstap responses. Optimize TCP source port selection on Linux. and m...

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named),

which resolves host names to IP addresses; a resolver library

(routines for applications to use when interfacing with DNS); and

tools for verifying that the DNS server is operating properly.

Update to 9.21.20 (rhbz#2440560) Security Fixes: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: Provide response round-trip time (RTT) counters via statistics channel. Introduce max-delegation-servers configuration option. Bug Fixes: Fix parsing key inactivation time in KASP code. Fix the handling of key statements defined inside views. Update to 9.21.19 Security Fixes: Fix a use-after-free error in dns_client_resolve() triggered by a DNAME response. Fix a NULL pointer dereference in qp-trie cache code. Immediately remove purged ADB names and entries from the SIEVE list. Feature Changes: Record query time for all dnstap responses. Optimize TCP source port selection on Linux. and m...

* Wed Mar 25 2026 Petr Men\u0161k - 32:9.21.20-1 - Update to 9.21.20 (rhbz#2440560)

[ 1 ] Bug #2440560 - bind9- -9.21.20 is available [ 2 ] Bug #2451573 - CVE-2026-3591 bind9- : BIND: Unauthorized access due to use-after-return vulnerability in DNS query handling [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-a6efefa854' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DNS Vulnerabilities in ISC BIND 9 Require Immediate Patching The Internet Systems Consortium (ISC) has released critical patches for multiple vulnerabilities in ISC BIND 9, a widely used DNS server software. Two high-severity vulnerabilities, CVE-2026-1519 and CVE-2026-3104, allow remote attackers to cause denial of service by sending crafted DNS queries without authentication. CVE-2026-1519 can lead to CPU exhaustion through excessive NSEC3 iterations, while CVE-2026-3104 causes memory leaks that can result in out-of-memory conditions. Both vulnerabilities affect BIND versions 9.20.0 to 9.21.19. ISC has not reported any active exploitation in the wild, and patches were available at the time of disclosure. Organizations are urged to prioritize updates and enhance monitoring for abnormal activity. The Centre for Cybersecurity Belgium has issued a warning, emphasizing the urgency of patching vulnerable systems. 3 sources 74

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (4)

CVE-2026-1519 CVE-2026-3104 CVE-2026-3119 CVE-2026-3591