Vulnerability · USN-8929-1

bind9 vulnerabilities

Published Oct 14, 2026 · corrected/updated Oct 17, 2026 · evidence confidence medium

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778) Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519) It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This is

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

USN-8929-1 is a unknown public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: bind9 (0 → 1:9.18.39-0ubuntu0.22.04.7); bind9 (0 → 1:9.18.39-0ubuntu0.24.04.8); bind9 (0 → 1:9.20.24-1ubuntu0.4); bind9 (0 → 1:9.9.5.dfsg-3ubuntu0.19+esm15). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: no CVSS/EPSS yet. It is not currently listed in the CISA Known Exploited catalog. Sources contributing to this record: osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Technology hubs

Ubuntu

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 14, 2026 · OpenSSF OSV / OSV Scanner
Detected
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly a
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm15; bind9 fixed in 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11; bind9 fixed in 1:9.11.3+dfsg-1ubuntu1.19+esm6; bind9 fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.9.5.dfsg-3ubuntu0.19+esm15
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.11.3+dfsg-1ubuntu1.19+esm6
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.18.39-0ubuntu0.22.04.7
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.18.39-0ubuntu0.24.04.8
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Fix available
bind9 fixed in 1:9.20.24-1ubuntu0.4
Oct 17, 2026 · OpenSSF OSV / OSV Scanner
Updated
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-8677) Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly a

Affected

Ubuntu:22.04:LTS bind90 → 1:9.18.39-0ubuntu0.22.04.7
Ubuntu:24.04:LTS bind90 → 1:9.18.39-0ubuntu0.24.04.8
Ubuntu:26.04:LTS bind90 → 1:9.20.24-1ubuntu0.4
Ubuntu:Pro:14.04:LTS bind90 → 1:9.9.5.dfsg-3ubuntu0.19+esm15
Ubuntu:Pro:16.04:LTS bind90 → 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Ubuntu:Pro:18.04:LTS bind90 → 1:9.11.3+dfsg-1ubuntu1.19+esm6
Ubuntu:Pro:20.04:LTS bind90 → 1:9.18.30-0ubuntu0.20.04.2+esm3

Sources

OpenSSF OSV / OSV ScannerPackage advisoryUSN-8929-1
bind9 vulnerabilities
osv.dev