SUSE Releases BIND Security Update for Enterprise Linux 15 SP5 and Leap 15.5
SUSE has published security update SUSE-SU-2026:4772-1, rated important, resolving ten separate vulnerabilities in the BIND DNS server package. The advisory, released on 20 October 2026, covers CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-77119, CVE-2026-78301 and CVE-2026-80274. Affected platforms include openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5 and its LTSS variant, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5 including the ESPOS and LTSS channels, and SUSE Linux Enterprise Micro 5.5. The fixed build across every affected product is bind-9.16.50-150500.8.46.1, together with the matching bind-utils, bind-doc, python3-bind and debuginfo packages. SUSE scores the individual issues between 6.9 and 8.9 under CVSS v4.0, and between 5.3 and 7.5 under CVSS v3.1, with no single flaw reaching the top of either scale.
The advisory describes each defect in enough detail to see the pattern. Three of the issues are memory-safety faults reachable by remote query traffic: CVE-2026-19662 is a use-after-free in the qpcache NOQNAME proof path that crashes a recursive resolver, CVE-2026-19666 is a use-after-free in query_addnoqnameproof() reached through the DNS64 filter64 code, and CVE-2026-80274 allows a validating resolver to abort while caching a mismatched NOQNAME proof. CVE-2026-19667 is a remote assertion failure caused by 16-bit length truncation in dns_ncache_add(). Two further flaws are resource-consumption problems — CVE-2026-19668 permits exhaustion through excessive DNSSEC cryptographic material matching, while CVE-2026-75029 causes the message parser to retain every identical singleton RDATA, producing what SUSE calls wire-to-work amplification. The remaining four are correctness failures in trust decisions: CVE-2026-19033 applies unauthenticated IXFR deltas to a live zone before TSIG verification, CVE-2026-19941 lets checkwildcard() accept an out-of-zone NSEC as a wildcard-nonexistence proof, CVE-2026-77119 allows an NSEC3 insecure-referral proof to rely on unrelated cached NSEC3 RRsets, and CVE-2026-78301 lets out-of-zone database nodes become authoritative zone cuts. The CVSS vectors for the integrity-focused issues record a high integrity impact with no privileges and no user interaction required, and CVE-2026-78301 additionally shows a scope change.
BIND sits at the base of most enterprise name resolution, so defects in it affect far more than the host running the daemon. The availability-side bugs give a remote party a path to knocking a resolver over with crafted query traffic, which on a central corporate or SAP-supporting resolver translates directly into broad service disruption, while the resource-consumption issues let a sender force disproportionate DNSSEC matching and RDATA retention work on the same machines. The integrity-side bugs carry the heavier consequence: applying zone transfer deltas before TSIG verification, or treating an out-of-zone record as a valid nonexistence proof, undermines exactly the controls that are supposed to make DNS answers trustworthy, and a party able to influence cached or zone data is positioned to steer clients to destinations of its choosing. The presence of LTSS and ESPOS channels in the affected list means long-lived, slow-moving production estates are in scope, which is where DNS servers tend to be both busiest and least frequently restarted, and where an unrestarted named process keeps running vulnerable code after the package itself has moved on. FIRST EPSS currently places all ten CVEs between 0.2% and 0.6% probability of exploitation activity in the next 30 days, and the fixed packages are already published in the affected product channels.
Attack Surface
Server OS, Infrastructure
Tactics
Impact, Initial Access, Defense Evasion
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1498 – Network Denial of Service
- T1565.002 – Data Manipulation: Transmitted Data Manipulation
SuperPRO's Threat Countermeasures Procedures
- Upgrade the bind, bind-utils, bind-doc, python3-bind and associated debuginfo packages to 9.16.50-150500.8.46.1 on all openSUSE Leap 15.5, SLES 15 SP5 and LTSS, SLES for SAP Applications 15 SP5, HPC 15 SP5 ESPOS and LTSS, and SLE Micro 5.5 hosts.
- Apply the vendor patch using the product-specific command from SUSE-SU-2026:4772-1, for example 'zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-4772' on SLES 15 SP5 LTSS, 'zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-4772' on SLES for SAP, or 'zypper in -t patch SUSE-2026-4772' on openSUSE Leap 15.5.
- Restart the named service after patching and confirm the running build with 'named -v' and 'rpm -q bind', since the use-after-free and assertion-failure fixes (CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-80274) only take effect once the long-lived daemon is reloaded.
- Restrict zone transfers on authoritative servers while patching is in progress by setting explicit allow-transfer ACLs keyed to known secondaries and firewalling TCP/53 to those peers, limiting exposure to the pre-TSIG IXFR handling in CVE-2026-19033.
- Limit recursion on resolvers to internal client ranges using allow-recursion and allow-query-cache in named.conf, and drop inbound UDP/53 and TCP/53 from the internet at the perimeter for any server that is not intentionally an authoritative public nameserver.
- Alert on named process crashes and restarts in systemd journal or syslog, specifically assertion failure messages from dns_ncache_add() and abnormal termination of named, as these are the observable outcome of CVE-2026-19667 and CVE-2026-80274.
- Monitor resolver CPU and memory against baseline and rate-limit high-volume query sources with the BIND rate-limit statement, since CVE-2026-19668 and CVE-2026-75029 allow a remote sender to force disproportionate DNSSEC matching and RDATA retention work.
