An update for bind is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4666 Final 1.0 1.0 2026-11-04 Initial 2026-11-04 2026-11-04 openEuler SA Tool V1.0 2026-11-04 bind security update An update for bind is now available for openEuler-22.03-LTS-SP4 Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fix(es): In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-19630) Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-94300) A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-96888) A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.(CVE-2026-97313) An update for bind is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High bind https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19630 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-94300 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-96888 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-97313 https://nvd.nist.gov/vuln/detail/CVE-2026-19630 https://nvd.nist.gov/vuln/detail/CVE-2026-94300 https://nvd.nist.gov/vuln/detail/CVE-2026-96888 https://nvd.nist.gov/vuln/detail/CVE-2026-97313 openEuler-22.03-LTS-SP4 bind-9.16.23-34.oe2203sp4.x86_64.rpm bind-chroot-9.16.23-34.oe2203sp4.x86_64.rpm bind-debuginfo-9.16.23-34.oe2203sp4.x86_64.rpm bind-debugsource-9.16.23-34.oe2203sp4.x86_64.rpm bind-devel-9.16.23-34.oe2203sp4.x86_64.rpm bind-dnssec-utils-9.16.23-34.oe2203sp4.x86_64.rpm bind-libs-9.16.23-34.oe2203sp4.x86_64.rpm bind-pkcs11-9.16.23-34.oe2203sp4.x86_64.rpm bind-pkcs11-devel-9.16.23-34.oe2203sp4.x86_64.rpm bind-pkcs11-libs-9.16.23-34.oe2203sp4.x86_64.rpm bind-pkcs11-utils-9.16.23-34.oe2203sp4.x86_64.rpm bind-utils-9.16.23-34.oe2203sp4.x86_64.rpm bind-dnssec-doc-9.16.23-34.oe2203sp4.noarch.rpm bind-license-9.16.23-34.oe2203sp4.noarch.rpm python3-bind-9.16.23-34.oe2203sp4.noarch.rpm bind-9.16.23-34.oe2203sp4.aarch64.rpm bind-chroot-9.16.23-34.oe2203sp4.aarch64.rpm bind-debuginfo-9.16.23-34.oe2203sp4.aarch64.rpm bind-debugsource-9.16.23-34.oe2203sp4.aarch64.rpm bind-devel-9.16.23-34.oe2203sp4.aarch64.rpm bind-dnssec-utils-9.16.23-34.oe2203sp4.aarch64.rpm bind-libs-9.16.23-34.oe2203sp4.aarch64.rpm bind-pkcs11-9.16.23-34.oe2203sp4.aarch64.rpm bind-pkcs11-devel-9.16.23-34.oe2203sp4.aarch64.rpm bind-pkcs11-libs-9.16.23-34.oe2203sp4.aarch64.rpm bind-pkcs11-utils-9.16.23-34.oe2203sp4.aarch64.rpm bind-utils-9.16.23-34.oe2203sp4.aarch64.rpm bind-9.16.23-34.oe2203sp4.src.rpm In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. 2026-11-04 CVE-2026-19630 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H bind security update 2026-11-04 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. 2026-11-04 CVE-2026-94300 openEuler-22.03-LTS-SP4 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H bind security update 2026-11-04 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666 A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. 2026-11-04 CVE-2026-96888 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H bind security update 2026-11-04 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666 A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. 2026-11-04 CVE-2026-97313 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H bind security update 2026-11-04 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4666