# Ubuntu patches 16 Bind DNS vulnerabilities across four LTS and interim releases

> **Key takeaway:** Ubuntu has released security updates for Bind 9 addressing sixteen CVEs, including remote code execution via GSS-TSIG context corruption and multiple DNSSEC-related attack vectors, with most severe flaws concentrated in Ubuntu 26.10.

**Published:** 2026-11-03T13:45:46+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-16-bind-dns-vulnerabilities-across-four-lts-a.html 

## Summary
Canonical published USN-8969-1 on November 3, 2026, patching sixteen vulnerabilities in the Bind 9 DNS server across Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. The flaws span denial-of-service conditions, cache poisoning, DNSSEC downgrade attacks, and one critical memory corruption issue permitting arbitrary code execution. Fourteen of the sixteen CVEs exclusively affected Ubuntu 26.10's newer Bind branch, while two vulnerabilities impacting compression pointer processing and GSS-TSIG serialization reached all supported releases. The most severe issue, CVE-2026-94300, involves incorrect serialization of shared GSS-TSIG security contexts that a remote attacker could exploit to corrupt memory and execute arbitrary code.

Affected packages span multiple Bind 9 versions: 9.18.39 for the 22.04 and 24.04 LTS branches, and 9.20.24 for 26.04 LTS and 26.10. The update requires no special configuration changes and deploys through standard system updates. Administrators running authoritative or recursive DNS servers, particularly those with DNSSEC validation, DNS64, RPZ, or TSIG-authenticated zone transfers enabled, should prioritize this update.

## Vulnerability breakdown by attack vector and affected releases
- **Memory exhaustion via singleton record repetition (CVE-2026-75029):** Bind failed to properly handle DNS messages containing repeated SOA, CNAME, or DNAME singleton records, allowing remote attackers to trigger excessive memory consumption and denial of service; Ubuntu 26.10 only.
- **DNSSEC proof validation failures (CVE-2026-19662, CVE-2026-19668, CVE-2026-77119, CVE-2026-80274):** Multiple flaws in cached DNSSEC proof handling, invalid DNSSEC record processing, NSEC3 sibling zone validation, and mixed NSEC/NSEC3 wildcard proofs enabled denial-of-service crashes, CPU exhaustion, DNSSEC downgrade attacks, and NXDOMAIN response forgery; all Ubuntu 26.10 only.
- **TSIG and zone transfer integrity compromise (CVE-2026-19033, CVE-2026-76163):** Missing global options blocks allowed TKEY query crashes, and insufficient TSIG signature verification during zone transfers permitted unauthorized zone content injection into secondary servers; both Ubuntu 26.10 only.
- **DNS64 and DNS-over-HTTPS crash vectors (CVE-2026-19666, CVE-2026-77692):** Malformed answers on DNS64-configured resolvers and invalid SIG(0) records in DNS-over-HTTPS requests caused Bind crashes; both Ubuntu 26.10 only.
- **Cross-release critical flaws (CVE-2026-19630, CVE-2026-94300):** Inadequate limits on compression pointer processing enabled CPU and memory exhaustion on all releases, while race conditions in GSS-TSIG security context serialization permitted memory corruption and arbitrary code execution across all supported Ubuntu versions.

## Why it matters
DNS infrastructure underpins virtually all network services in Linux environments, making these vulnerabilities particularly consequential for hosting providers, enterprise networks, and distribution mirrors that rely on Bind for authoritative or recursive resolution. The concentration of flaws in Ubuntu 26.10 suggests significant validation gaps in newer Bind feature additions around DNS-over-HTTPS, SVCB/HTTPS records, and DNSSEC automation, while the cross-release GSS-TSIG RCE vector exposes Kerberos-integrated DNS deployments regardless of version. Linux distribution maintainers and system administrators should treat this as a high-priority maintenance window, especially where TSIG-authenticated secondary replication or DNSSEC validation is active.