{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "ISC BIND 9: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/isc--bind-9/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/isc--bind-9/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 disclosed",
   "content_text": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\".\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in Alpine 3.22",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in Alpine 3.23",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in Alpine 3.24",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in Debian 13",
   "content_text": "Fixed versions: bind9 1:9.20.30-1~deb13u1.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in Debian 14",
   "content_text": "Fixed versions: bind9 1:9.20.30-1.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-97313/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-97313/",
   "title": "CVE-2026-97313 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: bind 9.20.30-1.1.",
   "date_published": "2026-10-21T12:47:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 disclosed",
   "content_text": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in Alpine 3.22",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in Alpine 3.23",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in Alpine 3.24",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in Debian 13",
   "content_text": "Fixed versions: bind9 1:9.20.30-1~deb13u1.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in Debian 14",
   "content_text": "Fixed versions: bind9 1:9.20.30-1.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-96888/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-96888/",
   "title": "CVE-2026-96888 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: bind 9.20.30-1.1.",
   "date_published": "2026-10-21T12:46:17Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 disclosed",
   "content_text": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in Alpine 3.22",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in Alpine 3.23",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in Alpine 3.24",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in Debian 13",
   "content_text": "Fixed versions: bind9 1:9.20.30-1~deb13u1.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in Debian 14",
   "content_text": "Fixed versions: bind9 1:9.20.30-1.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94300/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94300/",
   "title": "CVE-2026-94300 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: bind 9.20.30-1.1.",
   "date_published": "2026-10-21T12:45:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 disclosed",
   "content_text": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in Alpine 3.22",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in Alpine 3.23",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in Alpine 3.24",
   "content_text": "Fixed versions: bind 9.20.30-r0.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in Debian 13",
   "content_text": "Fixed versions: bind9 1:9.20.30-1~deb13u1.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in Debian 14",
   "content_text": "Fixed versions: bind9 1:9.20.30-1.",
   "date_published": "2026-10-21T12:41:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-19630/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-19630/",
   "title": "CVE-2026-19630 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: bind 9.20.30-1.1.",
   "date_published": "2026-10-21T12:41:04Z"
  }
 ]
}