CVE-2026-80274

A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.

This is an Important denial of service vulnerability in BIND resolvers. When DNSSEC validation is enabled, a specially crafted DNSSEC reply from an authoritative server can cause the BIND resolver to unexpectedly exit, leading to a disruption of DNS resolution services. This impacts the availability of DNS resolution on affected Red Hat systems configured with DNSSEC.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting dnssec-enable no; and dnssec-validation no; within the options block in named.conf or an included configuration file. A restart of the named service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data.