CLSA-2026-1780406874
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1780406874.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1780406874
- Upstream
- Published
- 2026-06-02T17:33:41Z
- Modified
- 2026-06-04T09:47:09.512732979Z
- Summary
- Fix CVE(s): CVE-2026-3039, CVE-2026-5946
- Details
-
- SECURITY UPDATE: Multiple assertion failures in named when handling DNS
messages with non-IN class (CHAOS, HESIOD) or meta-classes (ANY, NONE)
in UPDATE, NOTIFY, and recursion paths
- debian/patches/CVE-2026-5946.patch: disable recursion for non-IN views, reject UPDATE and NOTIFY for non-IN classes, validate DNS message CLASS early in request processing, reject NONE/ANY meta-classes in UPDATE and NOTIFY questions, and skip deny-answer-address for non-IN addresses in bin/named/server.c, lib/bind9/check.c, lib/dns/adb.c, lib/dns/message.c, lib/dns/resolver.c, lib/ns/client.c, lib/ns/update.c
- CVE-2026-5946
- SECURITY UPDATE: Multiple assertion failures in named when handling DNS
messages with non-IN class (CHAOS, HESIOD) or meta-classes (ANY, NONE)
in UPDATE, NOTIFY, and recursion paths
- References