Ubuntu notice USN-8969-1 covers many BIND DNS server vulnerabilities
- Severity
- High
- Sources
- 1
What happened
USN-8969-1 covers roughly 20 BIND issues, including CVE-2026-19033 (TSIG verification during zone transfers, allowing injection of unauthorised zone contents into a secondary), CVE-2026-19941 (NSEC wildcard proofs allowing forged NXDOMAIN), CVE-2026-77119 (NSEC3 validation from unrelated sibling zones, enabling DNSSEC downgrade) and CVE-2026-78301 (out-of-zone authoritative records and cache poisoning from malformed zones). CVE-2026-94300 (shared GSS-TSIG contexts serialised incorrectly) is described as potentially enabling memory corruption and arbitrary code execution. Most others are crash or resource-exhaustion DoS issues (e.g. CVE-2026-19662, CVE-2026-19668, CVE-2026-81563). The notice says most affect Ubuntu 26.10 only; it gives no fixed package versions in the text, so defenders should check the notice for patched builds and prioritise BIND hosts on that release.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether any servers run BIND on Ubuntu 26.10 and review the Ubuntu notice USN-8969-1 for the fixed packages.
- Install the updated BIND packages once they are available on your systems.
- Prioritise secondary servers that accept zone transfers, given the TSIG and cache poisoning issues.
Written by AI from the sources, checked against them
Full story timeline · 1 update
- Tue 3 NovemberUSN-8969-1: Bind vulnerabilitiesUbuntu Security Notices
Who reported · 1 outlet
Who and what is in it
Products