ZeroDay Findings
Sign inSign up

Findings

SUSE-SU-2026:4664-1

Security update for bind

Published Oct 14, 2026 · updated Oct 15, 2026

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435). - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436). - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (bsc#1280437). - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (bsc#1280438). - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440). - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442). - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OSV.dev

    Detected

    This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion f

  2. Oct 15, 2026 · OSV.dev

    Fix available

    bind fixed in 9.16.50-150400.5.70.1; bind fixed in 9.16.50-150400.5.70.1; bind fixed in 9.16.50-150400.5.70.1; bind fixed in 9.16.50-150400.5.70.1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    bind fixed in 9.16.50-150400.5.70.1

  4. Oct 15, 2026 · OSV.dev

    Updated

    This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432). - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433). - CVE-2026-19667: Remote assertion f

Affected

  • SUSE:Linux Enterprise High Performance C bind0 → 9.16.50-150400.5.70.1
  • SUSE:Linux Enterprise Server 15 SP4-LTSS bind0 → 9.16.50-150400.5.70.1
  • SUSE:Linux Enterprise Server for SAP App bind0 → 9.16.50-150400.5.70.1

Sources

  • OSV.devPackage advisorySUSE-SU-2026:4664-1

    Security update for bind

    osv.dev

References

SUSE-SU-2026:4664-1 · ZeroDay Findings