SUSE alert openSUSE-SU-2026:21123-1 (bind)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21123-1: important: Security update for bind
Date:
             
 
Tue, 30 Jun 2026 09:48:29 +0200
Message-ID:
             
 
<20260630074829.81149FF7F@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for bind
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21123-1
Rating: important
References:

  * bsc#1265591
  * bsc#1265592
  * bsc#1265593
  * bsc#1265594
  * bsc#1265595
  * bsc#1265596



Cross-References:

  * CVE-2026-3039
  * CVE-2026-3592
  * CVE-2026-3593
  * CVE-2026-5946
  * CVE-2026-5947
  * CVE-2026-5950



CVSS scores:

  * CVE-2026-3039 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-3592 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2026-3593 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2026-5946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-5947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-5950 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 6 vulnerabilities and has 6 bug fixes can now be installed.

Description:

This update for bind fixes the following issues

Upgrade to release 9.20.23:

- CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
- CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
- CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
(bsc#1265593).
- CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
- CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior
(bsc#1265595).
- CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-988=1

Package List:

- openSUSE Leap 16.0:

  bind-9.20.23-160000.1.1
  bind-doc-9.20.23-160000.1.1
  bind-modules-bdbhpt-9.20.23-160000.1.1
  bind-modules-generic-9.20.23-160000.1.1
  bind-modules-ldap-9.20.23-160000.1.1
  bind-modules-mysql-9.20.23-160000.1.1
  bind-modules-perl-9.20.23-160000.1.1
  bind-modules-sqlite3-9.20.23-160000.1.1
  bind-utils-9.20.23-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-3039.html
  * https://www.suse.com/security/cve/CVE-2026-3592.html
  * https://www.suse.com/security/cve/CVE-2026-3593.html
  * https://www.suse.com/security/cve/CVE-2026-5946.html
  * https://www.suse.com/security/cve/CVE-2026-5947.html
  * https://www.suse.com/security/cve/CVE-2026-5950.html