{
  "cves": [
    "CVE-2026-19630",
    "CVE-2026-94300",
    "CVE-2026-96888",
    "CVE-2026-97313"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[9.16.23-40.0.1.el9_8.13]\n- Fix warning when changing device file permissions [Orabug: 36518580]\n\n[32:9.16.23-40.13]\n- Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay.\n- Fix CVE-2026-97313: Denial of Service via assertion failure in RPZ query processing.\n- Fix CVE-2026-96888: Denial of Service via assertion failure during redirect processing.\n- Fix CVE-2026-19630: Denial of Service via unbounded processing of crafted DNS messages.\n\n[32:9.16.23-40.12]\n- Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.\n\n[32:9.16.23-40.11]\n- Backport 'Do not use header_prev in expire_lru_headers' from upstream. (RHEL-276913)\n\n[32:9.16.23-40.10]\n- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)\n- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)\n- Reject oversized negative cached records early (CVE-2026-19667)\n\n[32:9.16.23-40.9]\n- Add new root key 38696 into package files (RHEL-255763)\n- Update built-in anchors in delv and named\n\n[32:9.16.23-40.8]\n- Fix NSEC3 signer validation (CVE-2026-10723)\n\n[32:9.16.23-40.7]\n- Fix CVE-2026-13321: reject out-of-zone NSEC next owner names\n\n[32:9.16.23-40.6]\n- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)\n\n[32:9.16.23-40.5]\n- Fix dns_rdataset_addnoqname() accepting unsigned NSEC/NSEC3\n  (CVE-2026-13204)",
  "id": "ELSA-2026-93610",
  "ovalId": "oval:com.oracle.elsa:def:202693610",
  "source": "oracle_linux",
  "title": "ELSA-2026-93610:  bind security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-93610.html"
}