This security update addresses two high-severity vulnerabilities (CVE-2026-3039 and CVE-2026-5946, both CVSS 7.5) in BIND 9 that can lead to denial of service via memory exhaustion during GSS-API TKEY negotiation or via specially crafted DNS messages. Affected versions include BIND 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, and 9.21.0 through 9.21.21. The fixed versions are 9.18.49, 9.20.23, and 9.21.22.
Red Hat Product Errata RHSA-2026:24367 - Security Advisory Issued: 2026-06-08 Updated: 2026-06-08 RHSA-2026:24367 - Security Advisory Overview Updated Packages Synopsis Important: bind security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2479767 - CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation BZ - 2479771 - CVE-2026-5946 bind: BIND: Denial of Service via specially crafted DNS messages CVEs CVE-2026-3039 CVE-2026-5946 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM bind-9.16.23-40.el9_8.2.src.rpm SHA-256: 7e654b526082ba73e1bd3a7133d2a1503a2a7a4038e7c6f2bce003d763ca14f8 x86_64 bind-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 8d829dc736252c1e4d563844ca364670710395550fb559726e84f41d07323725 bind-chroot-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: e9c1fc2f6b77d750f04c8fa828420a5faefee528cfe5fc3a8795e29aeecf098c bind-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 19865768212d03eb6f309051a69cdca2e6d28cc70fd715154bcf7dd0fa18df19 bind-debugsource-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 7c72535ab4c53c0860fab289c911d083d356ec1dd077b6e3789af3ec233eb5a4 bind-dnssec-doc-9.16.23-40.el9_8.2.noarch.rpm SHA-256: 02e22edf542b4c20b82d73709b7f67f02ad412a64128f6d62a0690782d9f070c bind-dnssec-utils-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: b62b7850a03d5076520e53c91360822ca9979d94bb2f8d60c1489499fba4b83f bind-dnssec-utils-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: b6d066bf30d55a8cd5be27af640230c0769366c546946418e17c0012dd7716a9 bind-libs-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 705c230e5500c8135171d9b401061eaee897b8eacf26dd627a75978bdfe3c005 bind-libs-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 913511908fdb535ace959843c90fdf8d89157622c571259b8515f73f511c262f bind-license-9.16.23-40.el9_8.2.noarch.rpm SHA-256: dd3765429061138663ff13b155df45f05b3a196fc65c3a9ef7f25c0856a84de7 bind-utils-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 71f78d4a009d8bb6ccf031d44992df9ab6d7392901b11f5a39f86bc018bd5435 bind-utils-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 37c985da51141882c988b79fe65699f1a042ccf375074a1550be01c290a35a8a python3-bind-9.16.23-40.el9_8.2.noarch.rpm SHA-256: d7f86420df652c60345b5e70f2ac013b8c715c90b9648090e2c839233955be80 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM bind-9.16.23-40.el9_8.2.src.rpm SHA-256: 7e654b526082ba73e1bd3a7133d2a1503a2a7a4038e7c6f2bce003d763ca14f8 x86_64 bind-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 8d829dc736252c1e4d563844ca364670710395550fb559726e84f41d07323725 bind-chroot-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: e9c1fc2f6b77d750f04c8fa828420a5faefee528cfe5fc3a8795e29aeecf098c bind-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 19865768212d03eb6f309051a69cdca2e6d28cc70fd715154bcf7dd0fa18df19 bind-debugsource-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 7c72535ab4c53c0860fab289c911d083d356ec1dd077b6e3789af3ec233eb5a4 bind-dnssec-doc-9.16.23-40.el9_8.2.noarch.rpm SHA-256: 02e22edf542b4c20b82d73709b7f67f02ad412a64128f6d62a0690782d9f070c bind-dnssec-utils-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: b62b7850a03d5076520e53c91360822ca9979d94bb2f8d60c1489499fba4b83f bind-dnssec-utils-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: b6d066bf30d55a8cd5be27af640230c0769366c546946418e17c0012dd7716a9 bind-libs-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 705c230e5500c8135171d9b401061eaee897b8eacf26dd627a75978bdfe3c005 bind-libs-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 913511908fdb535ace959843c90fdf8d89157622c571259b8515f73f511c262f bind-license-9.16.23-40.el9_8.2.noarch.rpm SHA-256: dd3765429061138663ff13b155df45f05b3a196fc65c3a9ef7f25c0856a84de7 bind-utils-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 71f78d4a009d8bb6ccf031d44992df9ab6d7392901b11f5a39f86bc018bd5435 bind-utils-debuginfo-9.16.23-40.el9_8.2.x86_64.rpm SHA-256: 37c985da51141882c988b79fe65699f1a042ccf375074a1550be01c290a35a8a python3-bind-9.16.23-40.el9_8.2.noarch.rpm SHA-256: d7f86420df652c60345b5e70f2ac013b8c715c90b9648090e2c839233955be80 Red Hat Enterprise Linux for IBM z Systems 9 SRPM bind-9.16.23-40.el9_8.2.src.rpm SHA-256: 7e654b526082ba73e1bd3a7133d2a1503a2a7a4038e7c6f2bce003d763ca14f8 s390x bind-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 4d3e6562502ec2bd2b9b74b3085578ed299c5418f35f9d056161b43c6d71dcd4 bind-chroot-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 951c77191114847e84c957a8277aa03475a6d42d19e38c799f2e5d4f79fc6dff bind-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 09c2244d103163a8e97337cef33c471745637e1fac109e33c02d39f7a19d9e7f bind-debugsource-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 9732aaf61678a25b600b5e8ec66d6cab12acd7be03a9792b3c013023d7884b96 bind-dnssec-doc-9.16.23-40.el9_8.2.noarch.rpm SHA-256: 02e22edf542b4c20b82d73709b7f67f02ad412a64128f6d62a0690782d9f070c bind-dnssec-utils-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 6acfc600ab2bd2345fd2a9a53ba83b33d58ba48289b4346e2b088753b2ecec91 bind-dnssec-utils-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: c868553558d2650db0e2d89620ef3391c9a9cc349cd5578bb764e1a5e3699a58 bind-libs-9.16.23-40.el9_8.2.s390x.rpm SHA-256: b16e969ddc24af4b70c3929d86ff00f626f716f50522edb6c52b3ea699a96ea0 bind-libs-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: cb68dbe21185db9fcbae8321115780c731ffc97b589dc11008b801343478c1c8 bind-license-9.16.23-40.el9_8.2.noarch.rpm SHA-256: dd3765429061138663ff13b155df45f05b3a196fc65c3a9ef7f25c0856a84de7 bind-utils-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 72e74ef9f6cdc2136dd94850701079a7ed85a8a0b760a5aa2c8372d423eaedcc bind-utils-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: c2a47adfe4df494f3602c0ac81b26905ab4f0792f11354b6959d568a1c09177b python3-bind-9.16.23-40.el9_8.2.noarch.rpm SHA-256: d7f86420df652c60345b5e70f2ac013b8c715c90b9648090e2c839233955be80 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM bind-9.16.23-40.el9_8.2.src.rpm SHA-256: 7e654b526082ba73e1bd3a7133d2a1503a2a7a4038e7c6f2bce003d763ca14f8 s390x bind-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 4d3e6562502ec2bd2b9b74b3085578ed299c5418f35f9d056161b43c6d71dcd4 bind-chroot-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 951c77191114847e84c957a8277aa03475a6d42d19e38c799f2e5d4f79fc6dff bind-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 09c2244d103163a8e97337cef33c471745637e1fac109e33c02d39f7a19d9e7f bind-debugsource-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 9732aaf61678a25b600b5e8ec66d6cab12acd7be03a9792b3c013023d7884b96 bind-dnssec-doc-9.16.23-40.el9_8.2.noarch.rpm SHA-256: 02e22edf542b4c20b82d73709b7f67f02ad412a64128f6d62a0690782d9f070c bind-dnssec-utils-9.16.23-40.el9_8.2.s390x.rpm SHA-256: 6acfc600ab2bd2345fd2a9a53ba83b33d58ba48289b4346e2b088753b2ecec91 bind-dnssec-utils-debuginfo-9.16.23-40.el9_8.2.s390x.rpm SHA-256: c868553558d2650db0e2d89620ef3391c9a9cc349cd5578bb764e1a5e3699a58 bind-libs-9.16.23-40.el9_8.2.s390x.rpm SHA-256: b16e969ddc24af4b70c3929d86ff00f626f716f50522edb6c52b3ea699a96ea0 bind-libs-debuginfo-9.16.23-40.el9_8.2.s390x.rpm