On October 21, the two big open-source DNS servers shipped security updates on the same day: ISC's BIND 9.20.30 (development release 9.21.27) fixes four high-severity vulnerabilities, and NLnet Labs' Unbound 1.26.2 fixes five (1 high, 3 medium, 1 low). If you run your own recursive resolver or authoritative DNS on a VPS, this one is for you; if the server only uses the system's default resolver setup (such as systemd-resolved on Ubuntu) and has neither bind9 nor unbound installed, you are not affected — named -v and unbound -V will tell you whether either is installed.

BIND: Four High-Severity Flaws, All Remotely Exploitable

  • CVE-2026-94300 (CVSS 8.1): replaying GSS-TSIG signed UDP messages can corrupt memory in named. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid and, by also sending crafted queries to a zone the attacker controls, may potentially achieve remote code execution. GSS-TSIG is typically used in setups integrated with Active Directory.
  • CVE-2026-19630 (CVSS 7.5): a resolver processes inbound DNS messages with a particular structure with no limit at all, so a maliciously crafted message can exhaust CPU and memory.
  • CVE-2026-96888 (CVSS 7.5): a resolver configured with both a redirect zone and qname-minimization strict may abort with an assertion failure while processing the redirect.
  • CVE-2026-97313 (CVSS 7.5): a server that allows recursion and has at least two RPZ zones — one with recursive-only yes and one with recursive-only no — may exit with an assertion failure when an RD=1 query is followed by an RD=0 query.
  • Affected: 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26 (from 9.16.0 for 96888 and 97313). For all four, ISC lists no known workarounds, and it is not aware of active exploits.
  • Note that ISC's download page now marks 9.18.50 as EOL: the 9.18 branch is in the affected range, but ISC's fixed releases are only 9.20.30 and 9.21.27. 9.20 is supported until Q2 2028.

Unbound: The Worst One Only Hits DoQ Users

  • CVE-2026-97206 (high, affects 1.22.0 to 1.26.1): under multi-threaded operation, a remote DNS-over-QUIC (DoQ) client can trigger a QUIC path migration that leads to a use-after-free and a crash. If you don't serve DoQ, this one doesn't apply.
  • CVE-2026-109125 (medium, cache poisoning): a cache side-channel that can be used to probe the upstream source port exists only when unwanted-reply-threshold is set above 0, which is not the default.
  • CVE-2026-96405 (medium): many chained compression pointers can make Unbound burn a lot of CPU; 1.26.2 adds aggregate decompression limits of 2048 per upstream reply packet and 128,000 per zone transfer packet.
  • CVE-2026-50106 (medium) and CVE-2026-35501 (low) both concern DNSSEC validation when an island trust anchor is configured.

Distribution Status (as of October 26)

Debian 13 already has fixed packages: bind9 1:9.20.30-1~deb13u1 and unbound 1.26.2-0+deb13u1. Ubuntu 22.04 and 24.04 ship bind9 from the 9.18 series (9.18.39), and these CVEs are still marked needs-triage or needed on Ubuntu's pages; Debian 12 isn't fixed yet either. Note that Ubuntu's USN-8929-1 of October 14 fixed an earlier batch of BIND flaws, not these four. Until patches arrive, tighten access: open your recursive resolver only to your own servers and private network, never run an open resolver, and use a firewall to restrict which sources can reach port 53 — see VPS security hardening with ufw and SSH keys; if your server is being abused as an amplification relay, see emergency response to CC / DDoS attacks. If all you want is to point a domain at your VPS, the hosted DNS from your registrar or DNS provider is enough and there is no need to run your own; see pointing a domain to your VPS.