CLSA-2026-1792648513
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792648513
- Upstream
CVE (13)
- CVE-2025-40778
- CVE-2025-8677
- CVE-2026-10723
- CVE-2026-10822
- CVE-2026-11721
- CVE-2026-13204
- CVE-2026-19033
- CVE-2026-19662
- CVE-2026-19668
- CVE-2026-19941
- CVE-2026-75029
- CVE-2026-77119
- CVE-2026-78301
- Published
- 2026-10-22T05:55:37Z
- Modified
- 2026-10-26T09:43:52Z
- Summary
- Fix of 13 CVEs
- Details
-
- SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records
- debian/patches/CVE-2025-8677.patch: fail validation on invalid DNSKEY in lib/dns/validator.c.
- CVE-2025-8677
- SECURITY UPDATE: cache poisoning through forged records in answers
- debian/patches/CVE-2025-40778.patch: tighten resolver caching rules in lib/dns/resolver.c and lib/dns/message.c, and raise the default max-recursion-queries from 32 to 50 in bin/named/config.c.
- CVE-2025-40778
- SECURITY UPDATE: assertion failure on malformed PRIVATEDNS DNSKEY records
- debian/patches/CVE-2026-10822.patch: make dns_name_fromwire() honour the active region of the source buffer in lib/dns/name.c.
- CVE-2026-10822
- SECURITY UPDATE: crash from malformed NSEC/NSEC3 response
- debian/patches/CVE-2026-13204.patch: treat a missing NOQNAME proof as an error instead of an assertion failure in lib/dns/rbtdb.c, lib/dns/resolver.c and lib/ns/query.c.
- CVE-2026-13204
- SECURITY UPDATE: forged DNSSEC-validated NXDOMAIN responses
- debian/patches/CVE-2026-19941.patch: require NSEC wildcard proofs to be signed by the same zone as the NOQNAME proof in lib/dns/validator.c and lib/dns/include/dns/validator.h.
- CVE-2026-19941
- SECURITY UPDATE: DNSSEC validation bypass via NSEC3 impersonation
- debian/patches/CVE-2026-10723.patch: check that the NSEC3 signer matches the owning zone in lib/dns/dnssec.c and lib/isc/result.c.
- CVE-2026-10723
- SECURITY UPDATE: excessive CPU use validating crafted DNSSEC responses
- debian/patches/CVE-2026-19668.patch: bound the DS-to-DNSKEY matching during DNSSEC validation and make the exhausted quota terminal in lib/dns/validator.c and lib/dns/resolver.c.
- CVE-2026-19668
- SECURITY UPDATE: use-after-free of cached NOQNAME proofs
- debian/patches/CVE-2026-19662.patch: keep the cache slabheader that owns a NOQNAME or closest-encloser proof referenced while the proof rdatasets are in use in lib/dns/rbtdb.c.
- CVE-2026-19662
- SECURITY UPDATE: out-of-zone data above the apex treated as a zone cut
- debian/patches/CVE-2026-78301.patch: ignore nodes above the zone origin in RBT zone database lookups in lib/dns/rbtdb.c.
- CVE-2026-78301
- SECURITY UPDATE: sparsely signed incoming zone transfers accepted
- debian/patches/CVE-2026-19033.patch: require a TSIG on every message of an incoming zone transfer in lib/dns/xfrin.c.
- CVE-2026-19033
- SECURITY UPDATE: memory amplification via duplicate singleton records
- debian/patches/CVE-2026-75029.patch: skip duplicate singleton records when parsing DNS messages in lib/dns/message.c.
- CVE-2026-75029
- SECURITY UPDATE: DNSSEC downgrade of secure delegations via NSEC3
from an unrelated sibling zone
- debian/patches/CVE-2026-77119.patch: ignore NSEC3 records whose owner zone does not enclose the DS name in the insecure delegation proof in lib/dns/validator.c.
- CVE-2026-77119
- SECURITY UPDATE: invalid signed wildcard records accepted
- debian/patches/CVE-2026-11721.patch: reject RRSIG records whose labels field is lower than the signer label count when parsing and verifying in lib/dns/rdata/generic/rrsig_46.c and lib/dns/dnssec.c, and do not sign out-of-zone records in bin/dnssec/dnssec-signzone.c.
- CVE-2026-11721
- SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records
- References
-
- https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792648513.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-40778
- https://nvd.nist.gov/vuln/detail/CVE-2025-8677
- https://nvd.nist.gov/vuln/detail/CVE-2026-10723
- https://nvd.nist.gov/vuln/detail/CVE-2026-10822
- https://nvd.nist.gov/vuln/detail/CVE-2026-11721
- https://nvd.nist.gov/vuln/detail/CVE-2026-13204
- https://nvd.nist.gov/vuln/detail/CVE-2026-19033
- https://nvd.nist.gov/vuln/detail/CVE-2026-19662
- https://nvd.nist.gov/vuln/detail/CVE-2026-19668
- https://nvd.nist.gov/vuln/detail/CVE-2026-19941
- https://nvd.nist.gov/vuln/detail/CVE-2026-75029
- https://nvd.nist.gov/vuln/detail/CVE-2026-77119
- https://nvd.nist.gov/vuln/detail/CVE-2026-78301