rpm package
suse/bind&distro=SUSE Linux Enterprise Server for SAP applications 16.0
pkg:rpm/suse/bind&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
Vulnerabilities (14)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-5950 | Med | 5.3 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versi | |
| CVE-2026-5947 | Hig | 7.5 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would oc | |
| CVE-2026-5946 | Hig | 7.5 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching t | |
| CVE-2026-3593 | Hig | 7.4 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT af | |
| CVE-2026-3592 | Med | 5.3 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9 | |
| CVE-2026-3039 | Hig | 7.5 | < 9.20.23-160000.1.1 | 9.20.23-160000.1.1 | May 20, 2026 | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments | |
| CVE-2026-3591 | Med | 5.4 | < 9.20.21-160000.1.1 | 9.20.21-160000.1.1 | Mar 25, 2026 | A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addr | |
| CVE-2026-3119 | Med | 6.5 | < 9.20.21-160000.1.1 | 9.20.21-160000.1.1 | Mar 25, 2026 | Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affect | |
| CVE-2026-3104 | Hig | 7.5 | < 9.20.21-160000.1.1 | 9.20.21-160000.1.1 | Mar 25, 2026 | A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11 | |
| CVE-2026-1519 | Hig | 7.5 | < 9.20.21-160000.1.1 | 9.20.21-160000.1.1 | Mar 25, 2026 | If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: | |
| CVE-2025-13878 | Hig | 7.5 | < 9.20.18-160000.1.1 | 9.20.18-160000.1.1 | Jan 21, 2026 | Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1. | |
| CVE-2025-8677 | Hig | 7.5 | < 9.20.15-160000.1.1 | 9.20.15-160000.1.1 | Oct 22, 2025 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 thr | |
| CVE-2025-40780 | Hig | 8.6 | < 9.20.15-160000.1.1 | 9.20.15-160000.1.1 | Oct 22, 2025 | In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9. | |
| CVE-2025-40778 | Hig | 8.6 | < 9.20.15-160000.1.1 | 9.20.15-160000.1.1 | Oct 22, 2025 | Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11 |
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versi
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would oc
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching t
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT af
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9
- affected < 9.20.23-160000.1.1fixed 9.20.23-160000.1.1
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments
- affected < 9.20.21-160000.1.1fixed 9.20.21-160000.1.1
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addr
- affected < 9.20.21-160000.1.1fixed 9.20.21-160000.1.1
Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affect
- affected < 9.20.21-160000.1.1fixed 9.20.21-160000.1.1
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11
- affected < 9.20.21-160000.1.1fixed 9.20.21-160000.1.1
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see:
- affected < 9.20.18-160000.1.1fixed 9.20.18-160000.1.1
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.
- affected < 9.20.15-160000.1.1fixed 9.20.15-160000.1.1
Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 thr
- affected < 9.20.15-160000.1.1fixed 9.20.15-160000.1.1
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.
- affected < 9.20.15-160000.1.1fixed 9.20.15-160000.1.1
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11