ALAS2023-2026-2040: CVEs fixed (Amazon Linux)

ALAS2023-2026-2040 fixes 7 tracked CVEs. Affected systems and fixed versions.

CVE-2026-11622 HIGH 7.5 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer f
CVE-2026-12617 HIGH 7.5 The issue is unexpected program termination based on ordering and/or specific content in responses to queries
CVE-2026-13204 HIGH 7.5 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RR
CVE-2026-11331 HIGH 7.5 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names
CVE-2026-11721 HIGH 7.5 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels
CVE-2026-13321 HIGH 8.6 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the si
CVE-2026-10723 MEDIUM 6.8 BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authentica

Applies to