BIND Vulnerabilities Allow Remote Denial of Service Attacks

CERT-Bund has released security advisory WID-SEC-2026-0863 detailing critical vulnerabilities in Internet Systems Consortium BIND software, a widely used DNS server. The advisory highlights that remote attackers, authenticated or anonymous, can exploit these flaws to conduct denial-of-service (DoS) attacks or bypass security controls. The vulnerabilities have a CVSS Base Score of 7.5 (High) and a Temporal Score of 6.5 (Medium), indicating a significant security risk.

Organizations running affected versions of BIND, including specific versions on Fedora Linux and Ubuntu Linux, must take immediate action. The advisory indicates that mitigation is available, and users are strongly advised to update their BIND installations to patched versions (e.g., BIND >= 9.18.47, >= 9.20.21, >= 9.21.20). Failure to patch could lead to service disruptions and potential security breaches, impacting network availability and integrity.