Bind Security Update — AlmaLinux 10 (ALSA-2026:92419)

ALSA-2026:92419 updates BIND on AlmaLinux 10 with four CVE fixes (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) — including CVE-2026-94300, the ISC advisory DirectAdmin flagged last month — at aggregate CVSS 7.5 (CWE-407 inefficient algorithmic complexity). Update the bind packages: dnf update bind and restart named.

High 7.5 CVSS 2026-10-30

AlmaLinux 10

Was das unter einer SharedLicense-Lizenz bedeutet

Algorithmic-complexity flaws in DNS let crafted queries drive named into sustained high CPU — a remote denial-of-service against the service every hosted domain depends on.

Type:

security

Severity:

important

Release date:

2026-10-30

Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	bind-chroot-9.18.33-15.el10_2.14.aarch64.rpm	070e4f2ba8957a3b3fd6d61d7a146d10ffc7960812dadb942716db4c78649731
aarch64	bind-devel-9.18.33-15.el10_2.14.aarch64.rpm	3f85ec94ba9d642df1b598fb28ddbff8bb3ddb26b54b739f8ae3cdf489be75d5
aarch64	bind-9.18.33-15.el10_2.14.aarch64.rpm	7bbe8fde663d0b4c74cdb5da91442c62f6d47738115acf468a6830405b1301da
aarch64	bind-dnssec-utils-9.18.33-15.el10_2.14.aarch64.rpm	9901167deb5c26bd3fb898df7742d49b2b70541f0be75ed2bcf22cf65e6d118b
aarch64	bind-libs-9.18.33-15.el10_2.14.aarch64.rpm	d5c1034c8845437995bd949c44dcab974d8c2cc4cf70d36b700b19bb1475e299
aarch64	bind-utils-9.18.33-15.el10_2.14.aarch64.rpm	f07a713462dc8111b711f162a1c358d3eff566cbbb379dee6033ccfb0161a716
noarch	bind-doc-9.18.33-15.el10_2.14.noarch.rpm	1000f3acb26e751f73e8371e63dc392716e60232f17387eb1c9651482ae11305
noarch	bind-license-9.18.33-15.el10_2.14.noarch.rpm	23f2473a5700879bdf390f9a6cf40cc045ac12548cdfc22390e366896aa3c673
ppc64le	bind-devel-9.18.33-15.el10_2.14.ppc64le.rpm	1b877b61a9e0dec0c4596000231be0e4fedea8c2f59fd942c61c1b66a2b71ee3
ppc64le	bind-dnssec-utils-9.18.33-15.el10_2.14.ppc64le.rpm	1ba96a7dec93ca187e860cd9f391beb95775f97b4cdbfb542c92a7fd0dcf9168
ppc64le	bind-utils-9.18.33-15.el10_2.14.ppc64le.rpm	4c95d8d81af0ee745e394eeeab926b4820de724ee131362de310f9810c45b5f8
ppc64le	bind-chroot-9.18.33-15.el10_2.14.ppc64le.rpm	587fb5a366dd979ad944350a2e7d0e28aeb348e09761f2d36bf047a4e517afe9
ppc64le	bind-libs-9.18.33-15.el10_2.14.ppc64le.rpm	6b95f55730f388b6e054d81d6528350b708b2c0e17751b4853667d5f3e645855
ppc64le	bind-9.18.33-15.el10_2.14.ppc64le.rpm	a2dc8e5c5791ced3e853741e1f6e8ed928eb17ab5e65bde6f46b622adce38ba6
s390x	bind-utils-9.18.33-15.el10_2.14.s390x.rpm	455779eef6e257c2dcd6f7466ed5d9e7abe4c1a6ee574270fa094dda03ec2cd9
s390x	bind-devel-9.18.33-15.el10_2.14.s390x.rpm	65d40c11ae0d79c1b83103bf9b5f18856d61e76d6644fc099cea027bad6524a6
s390x	bind-9.18.33-15.el10_2.14.s390x.rpm	76bd288d344945e69d1b7c1ee7d464b3def3bfa5ffdfa39fa3623ce11c0e7cde
s390x	bind-libs-9.18.33-15.el10_2.14.s390x.rpm	ba26585f96e24ccf24eaf76b5ed5df0a858299a16cb9057c1809a68eaf7bace4
s390x	bind-chroot-9.18.33-15.el10_2.14.s390x.rpm	cc7f9fead88027a1899b057cd491148a32165f2b610ccb461a1253950a27b242
s390x	bind-dnssec-utils-9.18.33-15.el10_2.14.s390x.rpm	d547454089408c4a23f22b7aeb5e02d170ded9fde785fdcf5536072b14339218
x86_64	bind-devel-9.18.33-15.el10_2.14.x86_64.rpm	1b403ad8671e8227cde24ca1015df5bb604fdff5d592ee4dbbd2bf03a8a1ce1d
x86_64	bind-dnssec-utils-9.18.33-15.el10_2.14.x86_64.rpm	714e0f7dc3dff394a1ddd849016917c8899691d9f9f9faa5e5d56021d30a79dc
x86_64	bind-libs-9.18.33-15.el10_2.14.x86_64.rpm	8e895b97bd37205b08dc141fa54b51389d9eb3b137719bf9eb6af94a22291e39
x86_64	bind-chroot-9.18.33-15.el10_2.14.x86_64.rpm	a5093b12c0b9c44377fb69c2a8394baebafe6f975d66ed0fb82c99e872e6cb3e
x86_64	bind-9.18.33-15.el10_2.14.x86_64.rpm	c7dd640574d783c27b3375efd1c26479e6758d6337dcac6b0eade7cd3845a579
x86_64	bind-utils-9.18.33-15.el10_2.14.x86_64.rpm	cd46affcb28a42fc9ca0b74af7fcb0d43b51de2fa5c79d27ad146c76fee2916a
x86_64_v2	bind-libs-9.18.33-15.el10_2.14.x86_64_v2.rpm	46b37cb0e57ca3f3756ea9972321bede3ef88fe7539917b22da54e0daeff38fe
x86_64_v2	bind-devel-9.18.33-15.el10_2.14.x86_64_v2.rpm	5a6f5adf940872f810f43a3ed834f2940c5c29783a8b7e7d5bb490140d21fc2f
x86_64_v2	bind-chroot-9.18.33-15.el10_2.14.x86_64_v2.rpm	b28f6d96c8b595e95052dfe9b78e37e4fd8f7e07edef2d3aa8c14f7c1a25fdef
x86_64_v2	bind-utils-9.18.33-15.el10_2.14.x86_64_v2.rpm	c7c2d5c694326cec2c2b2675f5231b46dc9eae6df16413d84fd10a96c350f917
x86_64_v2	bind-dnssec-utils-9.18.33-15.el10_2.14.x86_64_v2.rpm	d852c8b9886922b5473d2b795c3074e88aff128d3c12b08b61fd8cff30bffb7b
x86_64_v2	bind-9.18.33-15.el10_2.14.x86_64_v2.rpm	f3b0b32a8e2019aa0e6ce94fd33b1d37a18e4963b4025e8317c3413bda596426

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:92419?

It is AlmaLinux's BIND erratum for AlmaLinux 10, fixing four CVEs (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) at aggregate CVSS 7.5 — algorithmic-complexity class (CWE-407) issues in the DNS implementation.

Is this the Bind advisory DirectAdmin flagged?

It includes CVE-2026-94300 — the ISC-advisory flaw raised on the DirectAdmin forum in September. AlmaLinux 10 servers get the fix through this package update rather than any panel component.

How do I apply the fix?

Run dnf update bind and restart the named service (systemctl restart named). Verify the package version afterwards; DNS downtime is seconds if the restart is scripted.

How severe are algorithmic-complexity DNS flaws?

They enable cheap-to-send, expensive-to-process queries — a remote denial-of-service lever against your DNS. Since every hosted domain resolves through named, apply the update in your next maintenance window.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen