SUSE-SU-2026:3452-1: bind&distro=SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:3452-1 is a vulnerability in bind&distro=SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 03-08-2026
   PublishedVulnerability first disclosed.
2. 04-08-2026
   Last modifiedVulnerability information updated.

Description

Security update for bind This update for bind fixes the following issues: - CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones (bsc#1271982). - CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm identifier length can trigger a consistency check failure (bsc#1271983). - CVE-2026-11331: handling NAMETOOLONG error conditions incorrectly during RPZ wildcard CNAME processing can allow bypassing RPZ rules or triggering process exits (bsc#1271984). - CVE-2026-11622: DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage exceeding max-cache-size and affecting response rate (bsc#1271986). - CVE-2026-11721: RRSIG with fewer labels than its containing zone when synth-from-dnssec is enabled can lead to wildcard generation (bsc#1271987). - CVE-2026-12617: delayed or specific CNAME/DNAME query responses combined with positive A record responses can trigger an assertion failure (bsc#1271988). - CVE-2026-13204: validating a domain covered by both NSEC and NSEC3 with an RRSIG for only one type can trigger an assertion failure (bsc#1271989). - CVE-2026-13321: NSEC records with a `Next Domain Name` pointing outside the signer's zone can allow cross-zone cache poisoning and authenticated denial-of-service responses (bsc#1271990). - Update to release 9.18.50: * Remove ineffective TCP fallback after repeated UDP timeouts. * Fall back to TCP on receipt of a UDP response with a mismatched query ID. * Fix DNS64 owner case after DNAME restart. * Clear REDIRECT flag when it isn't needed.

No weakness data has been published for this record.