The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103695 advisory.

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102693 advisory.

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3452-1 advisory.

    - CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge     authenticated       NXDOMAIN responses for sibling zones (bsc#1271982).
    - CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm identifier length can     trigger a       consistency check failure (bsc#1271983).
    - CVE-2026-11331: handling NAMETOOLONG error conditions incorrectly during RPZ wildcard CNAME processing     can allow       bypassing RPZ rules or triggering process exits (bsc#1271984).
    - CVE-2026-11622: DNSSEC validating resolver under a random subdomain attack can suffer from runaway     memory usage       exceeding max-cache-size and affecting response rate (bsc#1271986).
    - CVE-2026-11721: RRSIG with fewer labels than its containing zone when synth-from-dnssec is enabled can     lead to       wildcard generation (bsc#1271987).
    - CVE-2026-12617: delayed or specific CNAME/DNAME query responses combined with positive A record     responses can trigger       an assertion failure (bsc#1271988).
    - CVE-2026-13204: validating a domain covered by both NSEC and NSEC3 with an RRSIG for only one type can     trigger an       assertion failure (bsc#1271989).
    - CVE-2026-13321: NSEC records with a `Next Domain Name` pointing outside the signer's zone can allow     cross-zone cache       poisoning and authenticated denial-of-service responses (bsc#1271990).

    - Update to release 9.18.50:

     * Remove ineffective TCP fallback after repeated UDP timeouts.
     * Fall back to TCP on receipt of a UDP response with a mismatched query ID.
     * Fix DNS64 owner case after DNAME restart.
     * Clear REDIRECT flag when it isn't needed.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2040 advisory.

    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge     authenticated NXDOMAIN responses.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-10723)

    If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data,     and may subsequently abort and exit.

    BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a     PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the     actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record     to text, it will use the invalid length during processing, leading to a consistency check failing.This     issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-10822)

    An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query     names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled     correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9     software.This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through     9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11331)

    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can     suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver     can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured     in the `max-cache-size` parameter.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0     through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
    (CVE-2026-11622)

    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of     labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a     zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to     have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the     default).This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through     9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-11721)

    The issue is unexpected program termination based on ordering and/or specific content in responses to     queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record     below the DNAME to the resolver, and the authoritative server responds positively to the A query but     delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client     queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds     positively to the A query but delays the CNAME response and later responds with a self-referential CNAME,     the same failure may occur.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through     9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-12617)

    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0     through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13204)

    The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside     the signer's zone.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24,     9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13321)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3477-1 advisory.

    This update for bind fixes the following issues

    - CVE-2026-10723: Incorrect acceptance of NSEC3 records (bsc#1271982).
    - CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass (bsc#1271984).
    - CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986).
    - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards     (bsc#1271987).
    - CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
    - CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (bsc#1271990).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54509 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54654 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55442 advisory.

    - Fix NSEC3 signer validation (CVE-2026-10723, RHEL-215704)
    - Reject out-of-zone NSEC next owner names (CVE-2026-13321,       RHEL-213314)
    - Fix cache exhaustion via dns_slabheaders (CVE-2026-11622,       RHEL-213389)
    - Reject invalid signed wildcard records (CVE-2026-11721,       RHEL-213417)
    - Fix RPZ wildcard expansion self-referential CNAME       (CVE-2026-11331, RHEL-213495)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1553:08 advisory.

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
      * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
      * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
      * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
      * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-875d2a5154 advisory.

    Fixes multiple CVEs

    - Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
    - Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822)
    - Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617)
    - Potential memory usage beyond configured limits (CVE-2026-11622)
    - Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
    - Incorrect acceptance of NSEC3 records (CVE-2026-10723)
    - Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
    - DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0265 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-10723:
    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge     authenticated NXDOMAIN responses.
    This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11622:
    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can     suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver     can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured     in the `max-cache-size` parameter.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11721:
    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of     labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a     zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to     have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default).
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13204:
    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13321:
    The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside     the signer's zone.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_54510 advisory.

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
338154	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103695)	Nessus	Unity Linux Local Security Checks	2026/8/19	2026/8/19	high
338571	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bind (UTSA-2026-102693)	Nessus	Unity Linux Local Security Checks	2026/8/21	2026/8/21	high
331849	SUSE SLES15 Security Update : bind (SUSE-SU-2026:3452-1)	Nessus	SuSE Local Security Checks	2026/8/4	2026/8/4	high
332053	Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-2040)	Nessus	Amazon Linux Local Security Checks	2026/8/4	2026/8/4	high
332129	SUSE SLES15 Security Update : bind (SUSE-SU-2026:3477-1)	Nessus	SuSE Local Security Checks	2026/8/5	2026/8/5	high
335125	RHEL 8 : bind9.16 (RHSA-2026:54509)	Nessus	Red Hat Local Security Checks	2026/8/13	2026/8/13	high
335249	RHEL 8 : bind (RHSA-2026:54654)	Nessus	Red Hat Local Security Checks	2026/8/13	2026/8/13	high
338023	Oracle Linux 9 : bind9.18 (ELSA-2026-55442)	Nessus	Oracle Linux Local Security Checks	2026/8/19	2026/8/19	high
338050	MiracleLinux 8 : bind-9.11.36-16.el8_10.14 (AXSA:2026-1553:08)	Nessus	Miracle Linux Local Security Checks	2026/8/19	2026/8/19	high
341822	Fedora 43 : bind (2026-875d2a5154)	Nessus	Fedora Local Security Checks	2026/8/31	2026/8/31	high
342083	Alibaba Cloud Linux 3 : 0265: bind (ALINUX3-SA-2026:0265)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/9/1	2026/9/1	high
358035	Rocky Linux 9 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2026_54510)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high