[CLSA-2026:1794376114] Fix CVE(s): CVE-2026-11721, CVE-2026-13204, CVE-2026-13321
Type:
security
Severity:
Important
Release date:
2026-11-11 05:48:48 UTC
Description:
* SECURITY UPDATE: a resolver accepted validly-signed NSEC records whose Next Domain Name points outside the signer's zone - debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose Next Domain Name is outside the signer's zone (upstream 3bc7280158) - CVE-2026-13321 * SECURITY UPDATE: named could abort on an assertion while validating an insecurity proof covered by both NSEC and NSEC3 with an RRSIG for only one of them - debian/patches/CVE-2026-13204.patch: fail instead of asserting when no signed NSEC/NSEC3 proof is found (upstream 204fde8595) - CVE-2026-13204 * SECURITY UPDATE: an RRSIG with fewer labels than its signer could make named synthesize a wildcard above the signer's zone and poison the cache - debian/patches/CVE-2026-11721.patch: reject RRSIGs whose Labels field is below the signer's label count, and stop dnssec-signzone signing out-of-zone records (upstream 06778424f0 e5b16cfd1c) - CVE-2026-11721
CVEs fixed:
Updated packages:
  • bind9_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:6aadedcbefac6c1ffd86a632f71a94bb5332c7c4
  • bind9-doc_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_all.deb
    sha:a3a602fdb3a96695c2562c0f73d5aa895257ef69
  • bind9-host_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:8f2aec63028c6d732285a14108200748c87b5211
  • bind9utils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:a589010bae975fdc87fcbf309b3769d21f589739
  • dnsutils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:6e9135fb1082416837e14ff126382d428b594ace
  • libbind-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:3465e4c0368ebb32e3097aac51499ef52ac68da6
  • libbind-export-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:8ed90e2d9d2e15c799b3913cee3d58eb5095c5ae
  • libbind9-161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:e0d7a5594e0cf613f7a389c5a7c251c7f400a77a
  • libdns-export1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:1551dc50b9375e74922193147b559d6373cf436c
  • libdns1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:834b72d8a57a266bdefedea042a1ec58647ef311
  • libirs-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:b381d90d36db29d105c08b0bbee870a378800dee
  • libirs161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:d51b3d6edf48a2120da7ffefaecd717238144e39
  • libisc-export1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:b1f4c3343b7d2b889c98c44cbaf1e753b2d6e986
  • libisc1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:35500e93be2d59510867852227a5b13f948c60b2
  • libisccc-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:94ca898ce5656d56399b9e76329ad847d3b085f6
  • libisccc161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:f9e9ad143985a103b2efc9b8e88ce1e09f91dfb2
  • libisccfg-export163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:be348bc25d998a0f670f42140b01702748e9ec6e
  • libisccfg163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:113f01a9f043aef3860d3b1b9d79871f5cec8575
  • liblwres161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_amd64.deb
    sha:7762c71ae3522c0e371b9f4b0c15de68be0968a5
  • bind9_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:8f729a48dab356829314ae64392dfff712cb956c
  • bind9-host_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:76d86d57ffd4ba4f8fabc6547c852acefa44b397
  • bind9utils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:9e44bb12bd3af8fe97477d96d6805ee74a82eab9
  • dnsutils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:ceadfdaaa1a875c7e97f86d3d8b48a951462d785
  • libbind-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:6c9a9b898e5e45d1d6fb183b522b8b72d0ff7115
  • libbind-export-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:44e0c796cc98f823c8fb2b4d4d04682f18279ca8
  • libbind9-161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:d94590143641d2bc74a8e998abf42163c583f053
  • libdns-export1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:fa41e4101237980891b9f6d442690092397eec4c
  • libdns1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:5fecbd6df91bdfcff49cd7083061a6a437210db8
  • libirs-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:1474367b45db36bd0213fd83bce8e3b42d920822
  • libirs161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:972f61afa2a6601595e1db1a5d991e9feeec7092
  • libisc-export1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:5f76ba973015420d7b37e0130e2f1f84ce04f37c
  • libisc1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:0bd93da471b3da864b82206657b808026a065999
  • libisccc-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:fba477fcf867a82d653e8e27fc388b4b7d0ade1c
  • libisccc161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:503791e7fcfce1734f9c9fef1209ef614390ff1b
  • libisccfg-export163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:831f5fad4f9b729e2df6e3fae24256ecd3c04e38
  • libisccfg163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:766bf65959234a2677a9844553f42b913d248318
  • liblwres161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_arm64.deb
    sha:840e258046f8a3a365ac10b6cc20a21b4d385fca
  • bind9_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:f735b13bc5075699b7a6841ba4da22deb8e6cefe
  • bind9-host_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:903ece3778da728056fdac6e7a4c016b2bad1405
  • bind9utils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:fed4a1cf23df62d0fe93c09f4027c2551da1435c
  • dnsutils_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:a3f8583a544b44b294c7e626786155d639343bea
  • libbind-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:45f2a293cd7f9301a6362a521ac5f2edb64ca014
  • libbind-export-dev_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:e631fcad67d57dc8c8091a88a669afaf24666d4d
  • libbind9-161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:039d372103f5b08c5ad340b362a1dc9cfba14962
  • libdns-export1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:0dca297bac6776766d54e3bb2cb338ddd8b040b3
  • libdns1104_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:4cf4330973b0eba85d4c37fa182076f2a3feb78e
  • libirs-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:a2f409578c2a6fba69d87b0e8c0ddd3a1e953566
  • libirs161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:6c9d41031c393584da7a34d55320779d99bfc5c0
  • libisc-export1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:99a75bd84824ef267153024e0bcb2d832feb390d
  • libisc1100_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:7c87b98fe7af33eb14e5cd8f5ebed82f3f704b89
  • libisccc-export161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:473aae0a752eaf2fff57f1eded77724117a56c56
  • libisccc161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:ff0b82e5ef706df921ed67b3408999713719676f
  • libisccfg-export163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:a01c6cc2060430944f7f2c1d52d7d8e6b5a974b8
  • libisccfg163_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:f76b1868824fabfb0c1f44ad7706d805c4117a01
  • liblwres161_9.11.5.P4+dfsg-5.1+deb10u11+tuxcare.els8_armel.deb
    sha:f1e8dd46240a82a58a8a2a057f7afc5f5dc29b64
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.