Bug 2535869

Summary: CVE-2026-19941 bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: bindAssignee: Petr Menšík <pemensik>
Status: ON_QA --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: anon.amish, dns-sig, mruprich, pemensik, zdohnal
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["f9730d2a-1b73-4e3b-b091-802b7c9a4400"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2535457    

Description Vladimir Vasilev 2026-09-17 08:50:12 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Comment 1 Fedora Update System 2026-10-16 13:12:26 UTC 
FEDORA-2026-aba85b9a89 (bind-9.18.51^git20261003.d0a87358-2.fc43 and bind-dyndb-ldap-11.11-15.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-aba85b9a89
Comment 2 Fedora Update System 2026-10-16 13:15:19 UTC 
FEDORA-2026-a5b5298a84 (bind-9.18.51^git20261003.d0a87358-2.fc44 and bind-dyndb-ldap-11.11-17.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a5b5298a84
Comment 3 Fedora Update System 2026-10-16 15:22:42 UTC 
FEDORA-2026-468290e984 (bind-9.18.51^git20261003.d0a87358-11.fc45 and bind-dyndb-ldap-11.11-18.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-468290e984
Comment 4 Fedora Update System 2026-10-16 16:39:33 UTC 
FEDORA-2026-56974571ee (bind-9.18.51^git20261003.d0a87358-11.fc46 and bind-dyndb-ldap-11.11-18.fc46) has been submitted as an update to Fedora 46.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-56974571ee
Comment 5 Fedora Update System 2026-10-17 01:56:47 UTC 
FEDORA-2026-468290e984 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-468290e984`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-468290e984

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 6 Fedora Update System 2026-10-17 02:25:57 UTC 
FEDORA-2026-a5b5298a84 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a5b5298a84`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a5b5298a84

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 7 Fedora Update System 2026-10-17 02:48:40 UTC 
FEDORA-2026-aba85b9a89 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-aba85b9a89`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-aba85b9a89

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 8 Fedora Update System 2026-10-19 18:04:30 UTC 
FEDORA-2026-56974571ee (bind-9.18.51^git20261003.d0a87358-12.fc46 and bind-dyndb-ldap-11.11-18.fc46) has been pushed to the Fedora 46 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 9 Fedora Update System 2026-10-20 04:31:07 UTC 
FEDORA-2026-468290e984 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-468290e984`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-468290e984

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 10 Fedora Update System 2026-10-20 04:45:01 UTC 
FEDORA-2026-a5b5298a84 (bind-9.18.51^git20261003.d0a87358-2.fc44 and bind-dyndb-ldap-11.11-17.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.