RHSA-2026:80501: CVEs fixed (Red Hat)

RHSA-2026:80501 fixes 6 tracked CVEs. Affected systems and fixed versions.

CVE-2026-11622 HIGH 7.5 A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer f
CVE-2026-13204 HIGH 7.5 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RR
CVE-2026-11331 HIGH 7.5 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names
CVE-2026-11721 HIGH 7.5 It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels
CVE-2026-13321 HIGH 8.6 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the si
CVE-2026-10723 MEDIUM 6.8 BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authentica

Applies to

RHEL 8.6 Advanced Mission Critical Update Support · fixed in bind9.16-9.16.23-0.7.el8_6.11
RHEL 8.6 Extended Update Support Long-Life Add-On · fixed in bind9.16-9.16.23-0.7.el8_6.11