On this page (6 sections)
On 3 November 2026 Ubuntu published USN-8969-1, a security notice for the bind9 package. It lists a long series of BIND 9 vulnerabilities, most of which let a remote attacker crash a DNS server or exhaust its memory or CPU. The notice header names Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS.
If you run your own recursive resolver or authoritative DNS on Ubuntu, or manage hosting servers that do, read the notice and check your package version. Websites depend on DNS, so a DNS server that crashes or stalls can affect the sites that rely on it.
What the notice covers
The Ubuntu notice describes issues in several areas of BIND: handling of repeated singleton records such as SOA, CNAME or DNAME, cached DNSSEC proofs, invalid DNSSEC records, DNS64, TKEY queries, TSIG verification on zone transfers, NSEC and NSEC3 proofs, DNS-over-HTTPS requests, SVCB/HTTPS records and negative cache records. Most are described as denial of service. A few have other effects:
- CVE-2026-19033: incorrect TSIG signature verification during zone transfers could let an attacker inject unauthorized zone contents into a secondary server.
- CVE-2026-19941: certain NSEC wildcard proofs could be used to forge NXDOMAIN responses and hide wildcard records.
- CVE-2026-78301: malformed zones with NS or DNAME nodes above the zone origin could cause out-of-zone records to be served as authoritative, leading to cache poisoning.
- CVE-2026-77119: NSEC3 records from unrelated sibling zones could enable a DNSSEC downgrade, with forged unsigned answers accepted.
These descriptions come from Ubuntu's notice. The research available for this article contains full records only for three of the CVEs, so details of the others are limited to Ubuntu's one-line summaries.
Technical details of the three documented CVEs
| CVE | Weakness | CVSS 3.1 | Effect |
|---|---|---|---|
| CVE-2026-75029 | CWE-405 asymmetric resource consumption | 5.3 | A response with many copies of a record that should exist once (such as SOA) can increase negative cache memory use |
| CVE-2026-19662 | CWE-416 use after free | 5.9 | A resolver can abort if an attacker-controlled authoritative server for a DNSSEC-signed zone sends crafted answers in a particular order and timing |
| CVE-2026-19668 | CWE-407 inefficient algorithmic complexity | 5.3 | A recursive resolver may use excessive resources when it meets large numbers of a particular kind of invalid DNSSEC record |
All three are network-reachable with no privileges or user interaction required, and the CVSS impact is on availability only. CVE-2026-19662 is rated attack complexity High because it needs specific answers in a specific order and timing, and the victim resolver must be induced to query a zone the attacker controls. For CVE-2026-19668, the advisory notes that default limits on max-records-per-type and max-types-per-name help mitigate the exposure. Details are in the ISC knowledge base entries for CVE-2026-75029, CVE-2026-19662 and CVE-2026-19668.
The upstream advisories list BIND 9.20.29 and 9.21.26 among their references. The research does not state which upstream release fixes which CVE for each branch, so check the ISC pages for exact fixed versions.
Who is affected
Only systems that actually run BIND's named service can be exposed. The CVE descriptions for CVE-2026-19662 and CVE-2026-19668 specifically mention recursive resolvers; CVE-2026-75029 describes responses received by named. The following is general guidance on who runs BIND. You are in scope if you operate:
- A recursive resolver for your network, hosting platform or customers.
- An authoritative or secondary DNS server, especially one doing zone transfers with TSIG (relevant to CVE-2026-19033 in the Ubuntu notice).
- A server with the bind9 package installed for any other reason.
A site that only uses a provider's DNS does not run this software itself, so the patching work sits with the provider.
How to check your exposure
First find out whether BIND is installed. This read-only command lists the installed bind9 package and its version on Ubuntu; no output means the package is not installed.
apt list --installed 2>/dev/null | grep -i bind9Next, see whether the service is running. On Ubuntu the service is normally named bind9, with named as an alias. This shows its state; look for "active (running)".
systemctl status bind9Finally, compare installed and available versions. If the candidate version is newer than the installed one, an update is available from Ubuntu's repositories; compare it against the fixed version in USN-8969-1 for your release.
apt-cache policy bind9What to do now
0 of 7 done
This command refreshes package lists, upgrades only the bind9 package and restarts the service. Run it with sudo; afterwards apt should report the upgraded version and the status command above should show the service active.
sudo apt update
sudo apt install --only-upgrade bind9
sudo systemctl restart bind9Detection and monitoring
Because the main impact described is denial of service, the early signs are operational: the BIND service restarting unexpectedly, memory growing steadily on a resolver, or sustained high CPU. Alert on process restarts and on resolver latency. From the outside, watching that your domain keeps resolving and that DNS records are unchanged helps you notice trouble quickly; Webforta Monitor covers uptime and DNS change monitoring, though it cannot tell you whether a server is vulnerable. For background, see uptime monitoring explained.
For broader hardening, the small business website security guide covers patch routines, and the DDoS protection basics guide explains why DNS availability matters.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.