{"cves":["CVE-2026-19630","CVE-2026-94300","CVE-2026-96888","CVE-2026-97313"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[9.16.23-40.0.1.el9_8.13]\n- Fix warning when changing device file permissions [Orabug: 36518580]\n\n[32:9.16.23-40.13]\n- Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay.\n- Fix CVE-2026-97313: Denial of Service via assertion failure in RPZ query processing.\n- Fix CVE-2026-96888: Denial of Service via assertion failure during redirect processing.\n- Fix CVE-2026-19630: Denial of Service via unbounded processing of crafted DNS messages.\n\n[32:9.16.23-40.12]\n- Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.\n\n[32:9.16.23-40.11]\n- Backport 'Do not use header_prev in expire_lru_headers' from upstream. (RHEL-276913)\n\n[32:9.16.23-40.10]\n- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)\n- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)\n- Reject oversized negative cached records early (CVE-2026-19667)\n\n[32:9.16.23-40.9]\n- Add new root key 38696 into package files (RHEL-255763)\n- Update built-in anchors in delv and named\n\n[32:9.16.23-40.8]\n- Fix NSEC3 signer validation (CVE-2026-10723)\n\n[32:9.16.23-40.7]\n- Fix CVE-2026-13321: reject out-of-zone NSEC next owner names\n\n[32:9.16.23-40.6]\n- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)\n\n[32:9.16.23-40.5]\n- Fix dns_rdataset_addnoqname() accepting unsigned NSEC/NSEC3\n  (CVE-2026-13204)","id":"ELSA-2026-93610","ovalId":"oval:com.oracle.elsa:def:202693610","source":"oracle_linux","title":"ELSA-2026-93610:  bind security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-93610.html"}