MGASA-2026-0541
- Source
- https://advisories.mageia.org/MGASA-2026-0541.html
- Import Source
- https://advisories.mageia.org/MGASA-2026-0541.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2026-0541
- Upstream
CVE (4)
- CVE-2026-19630
- CVE-2026-94300
- CVE-2026-96888
- CVE-2026-97313
- Published
- 2026-10-25T02:36:50Z
- Modified
- 2026-10-25T02:45:03Z
- Summary
- Updated bind package fixes security vulnerabilities
- Details
-
- In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing (CVE-2026-19630).
- Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution (CVE-2026-94300).
- A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect (CVE-2026-96888).
- A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no" (CVE-2026-97313).
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:10 / bind
Package
- Name
- bind
- Purl
- pkg:rpm/mageia/bind?arch=source&distro=mageia-10