USN-8969-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8969-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8969-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8969-1
Upstream
CVE (18)
Related
UBUNTU (18)
Published
2026-11-03T13:45:46Z
Modified
2026-11-03T21:34:46Z
Summary
bind9 vulnerabilities
Details

It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)

It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19662)

It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19668)

It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19666)

It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-76163)

It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue only affected Ubuntu 26.10. (CVE-2026-19033)

It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue only affected Ubuntu 26.10. (CVE-2026-19941)

It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-77692)

It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)

It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)

It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)

It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-80274)

It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19667)

It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)

It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory resources, leading to a denial of service. (CVE-2026-19630)

It was discovered that Bind incorrectly serialized access to shared GSS-TSIG security contexts. A remote attacker could possibly use this issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)

It was discovered that Bind incorrectly handled redirect zones when used together with strict QNAME minimization. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-96888)

It was discovered that Bind incorrectly handled certain RPZ configurations when processing queries with and without recursion. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-97313)

References

Affected packages

Ubuntu:22.04:LTS / bind9

Package

Name
bind9
Purl
pkg:deb/ubuntu/bind9?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:9.18.39-0ubuntu0.22.04.8

Affected versions

1:9.*
1:9.16.15-1ubuntu1
1:9.16.15-1ubuntu2
1:9.16.15-1ubuntu3
1:9.18.0-2ubuntu1
1:9.18.0-2ubuntu2
1:9.18.0-2ubuntu3
1:9.18.1-1ubuntu1
1:9.18.1-1ubuntu1.1
1:9.18.1-1ubuntu1.2
1:9.18.1-1ubuntu1.3
1:9.18.12-0ubuntu0.22.04.1
1:9.18.12-0ubuntu0.22.04.2
1:9.18.12-0ubuntu0.22.04.3
1:9.18.18-0ubuntu0.22.04.1
1:9.18.18-0ubuntu0.22.04.2
1:9.18.24-0ubuntu0.22.04.1
1:9.18.28-0ubuntu0.22.04.1
1:9.18.30-0ubuntu0.22.04.1
1:9.18.30-0ubuntu0.22.04.2
1:9.18.39-0ubuntu0.22.04.1
1:9.18.39-0ubuntu0.22.04.2
1:9.18.39-0ubuntu0.22.04.3
1:9.18.39-0ubuntu0.22.04.4
1:9.18.39-0ubuntu0.22.04.5
1:9.18.39-0ubuntu0.22.04.6
1:9.18.39-0ubuntu0.22.04.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.8"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-19630",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-94300",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-96888",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-97313",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8969-1.json"

Ubuntu:24.04:LTS / bind9

Package

Name
bind9
Purl
pkg:deb/ubuntu/bind9?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:9.18.39-0ubuntu0.24.04.9

Affected versions

1:9.*
1:9.18.18-0ubuntu2
1:9.18.21-0ubuntu1
1:9.18.24-0ubuntu3
1:9.18.24-0ubuntu4
1:9.18.24-0ubuntu5
1:9.18.28-0ubuntu0.24.04.1
1:9.18.30-0ubuntu0.24.04.1
1:9.18.30-0ubuntu0.24.04.2
1:9.18.39-0ubuntu0.24.04.1
1:9.18.39-0ubuntu0.24.04.2
1:9.18.39-0ubuntu0.24.04.3
1:9.18.39-0ubuntu0.24.04.5
1:9.18.39-0ubuntu0.24.04.6
1:9.18.39-0ubuntu0.24.04.7
1:9.18.39-0ubuntu0.24.04.8

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.9"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-19630",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-94300",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-96888",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-97313",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8969-1.json"

Ubuntu:26.10 / bind9

Package

Name
bind9
Purl
pkg:deb/ubuntu/bind9?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:9.20.24-1ubuntu3.1

Affected versions

1:9.*
1:9.20.18-1ubuntu2
1:9.20.23-1ubuntu1
1:9.20.24-1ubuntu2
1:9.20.24-1ubuntu3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.20.24-1ubuntu3.1"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.20.24-1ubuntu3.1"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.20.24-1ubuntu3.1"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.20.24-1ubuntu3.1"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.20.24-1ubuntu3.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-19033",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19630",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19662",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19666",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19667",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19668",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19941",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-75029",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-76163",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-77119",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-77692",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-78301",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-80274",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-81563",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-81736",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-94300",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-96888",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-97313",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8969-1.json"

Ubuntu:26.04:LTS / bind9

Package

Name
bind9
Purl
pkg:deb/ubuntu/bind9?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:9.20.24-1ubuntu0.5

Affected versions

1:9.*
1:9.20.11-1ubuntu2
1:9.20.11-1ubuntu3
1:9.20.18-1ubuntu1
1:9.20.18-1ubuntu2
1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.1
1:9.20.24-1ubuntu0.2
1:9.20.24-1ubuntu0.3
1:9.20.24-1ubuntu0.4

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.20.24-1ubuntu0.5"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.20.24-1ubuntu0.5"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.20.24-1ubuntu0.5"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.20.24-1ubuntu0.5"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.20.24-1ubuntu0.5"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2026-19630",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-94300",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-96888",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-97313",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8969-1.json"