USN-8293-1

Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-3039)

Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue records. A remote attacker could possibly use this issue to use Bind in denial of service amplification attacks against other systems. (CVE-2026-3592)

Naresh Kandula Parmar discovered that Bind incorrectly handled memory in the DNS-over-HTTPS implementation. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-3593)

It was discovered that Bind incorrectly handled DNS messages whose class was not IN. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-5946)

Naoki Wakamatsu discovered that Bind incorrectly handled SIG(0) validation during a query flood. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-5947)

Billy Baraja discovered that Bind had an unbounded resend loop in the resolver. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-5950)

References

Affected packages

Ubuntu:22.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.18.39-0ubuntu0.22.04.4

Affected versions

1:9.*

1:9.16.15-1ubuntu1

1:9.16.15-1ubuntu2

1:9.16.15-1ubuntu3

1:9.18.0-2ubuntu1

1:9.18.0-2ubuntu2

1:9.18.0-2ubuntu3

1:9.18.1-1ubuntu1

1:9.18.1-1ubuntu1.1

1:9.18.1-1ubuntu1.2

1:9.18.1-1ubuntu1.3

1:9.18.12-0ubuntu0.22.04.1

1:9.18.12-0ubuntu0.22.04.2

1:9.18.12-0ubuntu0.22.04.3

1:9.18.18-0ubuntu0.22.04.1

1:9.18.18-0ubuntu0.22.04.2

1:9.18.24-0ubuntu0.22.04.1

1:9.18.28-0ubuntu0.22.04.1

1:9.18.30-0ubuntu0.22.04.1

1:9.18.30-0ubuntu0.22.04.2

1:9.18.39-0ubuntu0.22.04.1

1:9.18.39-0ubuntu0.22.04.2

1:9.18.39-0ubuntu0.22.04.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.22.04.4"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8293-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3039"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3592"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5946"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5950"
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:24.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.18.39-0ubuntu0.24.04.5

Affected versions

1:9.*

1:9.18.18-0ubuntu2

1:9.18.21-0ubuntu1

1:9.18.24-0ubuntu3

1:9.18.24-0ubuntu4

1:9.18.24-0ubuntu5

1:9.18.28-0ubuntu0.24.04.1

1:9.18.30-0ubuntu0.24.04.1

1:9.18.30-0ubuntu0.24.04.2

1:9.18.39-0ubuntu0.24.04.1

1:9.18.39-0ubuntu0.24.04.2

1:9.18.39-0ubuntu0.24.04.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "bind9utils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        },
        {
            "binary_name": "dnsutils",
            "binary_version": "1:9.18.39-0ubuntu0.24.04.5"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8293-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3039"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3592"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5946"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5950"
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

Ubuntu:25.10 / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.20.11-1ubuntu2.4

Affected versions

1:9.*

1:9.20.4-3ubuntu1

1:9.20.4-3ubuntu2

1:9.20.4-3ubuntu3

1:9.20.9-2ubuntu1

1:9.20.10-1ubuntu1

1:9.20.11-1ubuntu1

1:9.20.11-1ubuntu2

1:9.20.11-1ubuntu2.1

1:9.20.11-1ubuntu2.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.20.11-1ubuntu2.4"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.20.11-1ubuntu2.4"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.20.11-1ubuntu2.4"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.20.11-1ubuntu2.4"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.20.11-1ubuntu2.4"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8293-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3039"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3592"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3593"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5946"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5947"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5950"
        }
    ],
    "ecosystem": "Ubuntu:25.10"
}

Ubuntu:26.04:LTS / bind9

Package

Name: bind9
Purl: pkg:deb/ubuntu/bind9?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.20.18-1ubuntu2.1

Affected versions

1:9.*

1:9.20.11-1ubuntu2

1:9.20.11-1ubuntu3

1:9.20.18-1ubuntu1

1:9.20.18-1ubuntu2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "bind9",
            "binary_version": "1:9.20.18-1ubuntu2.1"
        },
        {
            "binary_name": "bind9-dnsutils",
            "binary_version": "1:9.20.18-1ubuntu2.1"
        },
        {
            "binary_name": "bind9-host",
            "binary_version": "1:9.20.18-1ubuntu2.1"
        },
        {
            "binary_name": "bind9-libs",
            "binary_version": "1:9.20.18-1ubuntu2.1"
        },
        {
            "binary_name": "bind9-utils",
            "binary_version": "1:9.20.18-1ubuntu2.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8293-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3039"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3592"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-3593"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5946"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5947"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-5950"
        }
    ],
    "ecosystem": "Ubuntu:26.04:LTS"
}