USN-8648-1

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723)

It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822)

It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331)

It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605)

It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622)

It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721)

It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617)

It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

References

Affected packages

Ubuntu:22.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.18.39-0ubuntu0.22.04.5

Affected versions

1:9.*

1:9.16.15-1ubuntu1

1:9.16.15-1ubuntu2

1:9.16.15-1ubuntu3

1:9.18.0-2ubuntu1

1:9.18.0-2ubuntu2

1:9.18.0-2ubuntu3

1:9.18.1-1ubuntu1

1:9.18.1-1ubuntu1.1

1:9.18.1-1ubuntu1.2

1:9.18.1-1ubuntu1.3

1:9.18.12-0ubuntu0.22.04.1

1:9.18.12-0ubuntu0.22.04.2

1:9.18.12-0ubuntu0.22.04.3

1:9.18.18-0ubuntu0.22.04.1

1:9.18.18-0ubuntu0.22.04.2

1:9.18.24-0ubuntu0.22.04.1

1:9.18.28-0ubuntu0.22.04.1

1:9.18.30-0ubuntu0.22.04.1

1:9.18.30-0ubuntu0.22.04.2

1:9.18.39-0ubuntu0.22.04.1

1:9.18.39-0ubuntu0.22.04.2

1:9.18.39-0ubuntu0.22.04.3

1:9.18.39-0ubuntu0.22.04.4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.5"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8648-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-10723"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-10822"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11331"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11622"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11721"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12617"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-13321"
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:24.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.18.39-0ubuntu0.24.04.6

Affected versions

1:9.*

1:9.18.18-0ubuntu2

1:9.18.21-0ubuntu1

1:9.18.24-0ubuntu3

1:9.18.24-0ubuntu4

1:9.18.24-0ubuntu5

1:9.18.28-0ubuntu0.24.04.1

1:9.18.30-0ubuntu0.24.04.1

1:9.18.30-0ubuntu0.24.04.2

1:9.18.39-0ubuntu0.24.04.1

1:9.18.39-0ubuntu0.24.04.2

1:9.18.39-0ubuntu0.24.04.3

1:9.18.39-0ubuntu0.24.04.5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.6"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8648-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-10723"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-10822"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11331"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-11622"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11721"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-12617"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-13321"
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

Ubuntu:26.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.20.24-1ubuntu0.2

Affected versions

1:9.*

1:9.20.11-1ubuntu2

1:9.20.11-1ubuntu3

1:9.20.18-1ubuntu1

1:9.20.18-1ubuntu2

1:9.20.18-1ubuntu2.1

1:9.20.24-1ubuntu0.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.20.24-1ubuntu0.2"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.20.24-1ubuntu0.2"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.20.24-1ubuntu0.2"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.20.24-1ubuntu0.2"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.20.24-1ubuntu0.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8648-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-10723"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-10822"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-11331"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-11605"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11622"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-11721"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-12617"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-13321"
        }
    ],
    "ecosystem": "Ubuntu:26.04:LTS"
}