This advisory addresses two high-severity vulnerabilities (CVE-2026-3039 and CVE-2026-5946, both CVSS 7.5) in BIND 9, involving memory exhaustion during GSS-API TKEY negotiation and denial of service via crafted DNS messages. Affected versions include BIND 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, and 9.21.0 through 9.21.21. The fix requires upgrading to patched versions 9.18.49, 9.20.23, or 9.21.22, respectively.
Red Hat Product Errata RHSA-2026:24368 - Security Advisory Issued: 2026-06-08 Updated: 2026-06-08 RHSA-2026:24368 - Security Advisory Overview Updated Packages Synopsis Important: bind9.18 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for bind9.18 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2479767 - CVE-2026-3039 bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation BZ - 2479771 - CVE-2026-5946 bind: BIND: Denial of Service via specially crafted DNS messages CVEs CVE-2026-3039 CVE-2026-5946 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM bind9.18-9.18.29-14.el9_8.2.src.rpm SHA-256: 648b425a7a21309acf99c828b63dd9c4f9081613ce1dd01b04129ebae1be59e9 x86_64 bind9.18-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 39b5ae1f87884adc0053493fd5d0aff8bf238b79dbc73dbc9579a432380d9fbc bind9.18-chroot-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 0dac29c14ccd40daa8f9967812bffe4fb3a0d6432056cc0d8f708ab96ad3f133 bind9.18-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 9c094ec461b5a47aee34273690134139984ad1ced9c630490021ce5e0dcb6571 bind9.18-debugsource-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 116a9ec35b7c32e53c86b5b30f4c9ebbd0e7da37f81de33365c46dd5e627c85e bind9.18-dnssec-utils-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 8b836e6d8844abe00a922e732810a95c976d4e85fac79c0a1f34fc6ce7fa0293 bind9.18-dnssec-utils-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: f8c4b44ffc88294c2cfba3bb89f6794e8fb741f63fe0fc167ebb86ca652d6c35 bind9.18-libs-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 44661da507955f341cc4ec7158b22e90b705949bc8e9bed39ceda8614b9b66c3 bind9.18-libs-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 326142ef3d9b421668d2d6b0c5aea0cd1bb742c27ddd617aac47e299927aee34 bind9.18-utils-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 499333867396b9d1befcfbc1beefdc37fe071715ef59831a03b2cd96676b4f4d bind9.18-utils-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 4c8e46b847974124b02639aee0086e8085d840616db2a884715bdac25f89b43d Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM bind9.18-9.18.29-14.el9_8.2.src.rpm SHA-256: 648b425a7a21309acf99c828b63dd9c4f9081613ce1dd01b04129ebae1be59e9 x86_64 bind9.18-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 39b5ae1f87884adc0053493fd5d0aff8bf238b79dbc73dbc9579a432380d9fbc bind9.18-chroot-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 0dac29c14ccd40daa8f9967812bffe4fb3a0d6432056cc0d8f708ab96ad3f133 bind9.18-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 9c094ec461b5a47aee34273690134139984ad1ced9c630490021ce5e0dcb6571 bind9.18-debugsource-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 116a9ec35b7c32e53c86b5b30f4c9ebbd0e7da37f81de33365c46dd5e627c85e bind9.18-dnssec-utils-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 8b836e6d8844abe00a922e732810a95c976d4e85fac79c0a1f34fc6ce7fa0293 bind9.18-dnssec-utils-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: f8c4b44ffc88294c2cfba3bb89f6794e8fb741f63fe0fc167ebb86ca652d6c35 bind9.18-libs-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 44661da507955f341cc4ec7158b22e90b705949bc8e9bed39ceda8614b9b66c3 bind9.18-libs-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 326142ef3d9b421668d2d6b0c5aea0cd1bb742c27ddd617aac47e299927aee34 bind9.18-utils-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 499333867396b9d1befcfbc1beefdc37fe071715ef59831a03b2cd96676b4f4d bind9.18-utils-debuginfo-9.18.29-14.el9_8.2.x86_64.rpm SHA-256: 4c8e46b847974124b02639aee0086e8085d840616db2a884715bdac25f89b43d Red Hat Enterprise Linux for IBM z Systems 9 SRPM bind9.18-9.18.29-14.el9_8.2.src.rpm SHA-256: 648b425a7a21309acf99c828b63dd9c4f9081613ce1dd01b04129ebae1be59e9 s390x bind9.18-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 3df55c0e914530e5ccf999f1140c9a6a1c11089bd3fd73d6886b7bbfe9c4e8d6 bind9.18-chroot-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 3f699c339b954005c4aa9b9a5f1490ad54a21d53e837700aa9bb8ff1c085fbc0 bind9.18-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 1acdf19da9e6268a81060cb75132db9d4006dacab38af72a76ee1209be1c52bd bind9.18-debugsource-9.18.29-14.el9_8.2.s390x.rpm SHA-256: a613557e8c0ba76f9833a6ddb7b44a6ccf7a9d192f2201d2e9df8dd9fcc0284d bind9.18-dnssec-utils-9.18.29-14.el9_8.2.s390x.rpm SHA-256: fab68531887f97b311a005477e96f8ef32eb62e644c844625ed95500c23f2187 bind9.18-dnssec-utils-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 5320018c83d67d85b861b0608ce9c21789e8958b43f2dfe57b45d6c33e7586e1 bind9.18-libs-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 757180db63c38a3d90118a92c3c81becbb4944eb2339718a3bd5f09850a978f0 bind9.18-libs-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: a5bee49319cc34d9b1be0a019e85c347be005ad2e553c5ba86abc937dd5dd7e6 bind9.18-utils-9.18.29-14.el9_8.2.s390x.rpm SHA-256: aad75534888e156732c2eb4865bde93ac613073ed25bf86942e81734e576c54f bind9.18-utils-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 8b0e09b380e540e89469e8bdc0a168bafef7f67284df9f6bbd73b85962fc5701 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM bind9.18-9.18.29-14.el9_8.2.src.rpm SHA-256: 648b425a7a21309acf99c828b63dd9c4f9081613ce1dd01b04129ebae1be59e9 s390x bind9.18-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 3df55c0e914530e5ccf999f1140c9a6a1c11089bd3fd73d6886b7bbfe9c4e8d6 bind9.18-chroot-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 3f699c339b954005c4aa9b9a5f1490ad54a21d53e837700aa9bb8ff1c085fbc0 bind9.18-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 1acdf19da9e6268a81060cb75132db9d4006dacab38af72a76ee1209be1c52bd bind9.18-debugsource-9.18.29-14.el9_8.2.s390x.rpm SHA-256: a613557e8c0ba76f9833a6ddb7b44a6ccf7a9d192f2201d2e9df8dd9fcc0284d bind9.18-dnssec-utils-9.18.29-14.el9_8.2.s390x.rpm SHA-256: fab68531887f97b311a005477e96f8ef32eb62e644c844625ed95500c23f2187 bind9.18-dnssec-utils-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 5320018c83d67d85b861b0608ce9c21789e8958b43f2dfe57b45d6c33e7586e1 bind9.18-libs-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 757180db63c38a3d90118a92c3c81becbb4944eb2339718a3bd5f09850a978f0 bind9.18-libs-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: a5bee49319cc34d9b1be0a019e85c347be005ad2e553c5ba86abc937dd5dd7e6 bind9.18-utils-9.18.29-14.el9_8.2.s390x.rpm SHA-256: aad75534888e156732c2eb4865bde93ac613073ed25bf86942e81734e576c54f bind9.18-utils-debuginfo-9.18.29-14.el9_8.2.s390x.rpm SHA-256: 8b0e09b380e540e89469e8bdc0a168bafef7f67284df9f6bbd73b85962fc5701 Red Hat Enterprise Linux for Power, little endian 9 SRPM bind9.18-9.18.29-14.el9_8.2.src.rpm SHA-256: 648b425a7a21309acf99c828b63dd9c4f9081613ce1dd01b04129ebae1be59e9 ppc64le bind9.18-9.18.29-14.el9_8.2.ppc64le.rpm SHA-256: b8288e0f866919ce6d75eb889c39af9a18d1058bb6fb4ae4ef8429ef2c459a17 bind9.18-chroot-9.18.29-14.el9_8.2.ppc64le.rpm SHA-256: 715cc179572a0a9fb6c11d053d8c6345fa385c9205c68f9c1408e91938d4b0a5 bind9.18-debuginfo-9.18.29-14.el9_8.2.ppc64le.rpm SHA-256: 8f617fe04b9e4974724c62b884d9321eba6ed0fcf68acb9b5befd94c6d178b34 bind9.18-debugsource-9.18.29-14.el9_8.2.ppc64le.rpm SHA-256: cc4cd67d52c8f40d29ab9f7513025b38bdb8e242328d344ba5e9