CLSA-2026-1792089817
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792089817
- Upstream
CVE (3)
- CVE-2026-13321
- CVE-2026-19666
- CVE-2026-80274
- Published
- 2026-10-15T18:43:49Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2026-13321, CVE-2026-19666, CVE-2026-80274
- Details
-
- SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC
Next Domain Name
- debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose next owner name is not a subdomain of the RRSIG signer name in dns_dnssec_verify3() in lib/dns/dnssec.c.
- CVE-2026-13321
- SECURITY UPDATE: assertion failure with dns64 and break-dnssec
- debian/patches/CVE-2026-19666.patch: clear the noqname alias on the DNS64 filter64 path in query_find() in bin/named/query.c.
- CVE-2026-19666
- SECURITY UPDATE: crash on wildcard answers carrying both NSEC and NSEC3
proofs
- debian/patches/CVE-2026-80274.patch: record the denial type the validator accepted and use it when caching and serving the NOQNAME proof in lib/dns/validator.c, lib/dns/resolver.c and lib/dns/rdatalist.c; adds dns_rdataset_addnoqnametype() so dns_rdataset_addnoqname() keeps its signature.
- debian/libdns1100.symbols: add dns_rdataset_addnoqnametype.
- CVE-2026-80274
- Add root KSK-2024 (key tag 38696) trust anchor to bind.keys; fresh
installs could not validate the root zone after the 2026-10-11 rollover
- debian/patches/update-root-ksk-38696.patch: add the 38696 initial-key to bind.keys and the generated bind.keys.h (upstream 609bf35075, carried as initial-key because 9.11 has no initial-ds).
- SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC
Next Domain Name
- References