ALAS2-2026-3854: CVEs fixed (Amazon Linux)

ALAS2-2026-3854 fixes 5 tracked CVEs. Affected systems and fixed versions.

CVE-2026-11622 HIGH 7.5 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer f
CVE-2026-13204 HIGH 7.5 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RR
CVE-2026-11721 HIGH 7.5 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels
CVE-2026-13321 HIGH 8.6 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the si
CVE-2026-10723 MEDIUM 6.8 BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authentica

Applies to