{"id":"CLSA-2026-1792083184","summary":"Fix CVE(s): CVE-2026-13321, CVE-2026-19666, CVE-2026-80274","details":"   * SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC\n     Next Domain Name\n     - debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose next\n       owner name is not a subdomain of the RRSIG signer name in\n       dns_dnssec_verify3() in lib/dns/dnssec.c.\n     - CVE-2026-13321\n   * SECURITY UPDATE: assertion failure with dns64 and break-dnssec\n     - debian/patches/CVE-2026-19666.patch: clear the noqname alias on the\n       DNS64 filter64 path in query_find() in bin/named/query.c; add the\n       upstream dns64 system test for a partially excluded wildcard AAAA.\n     - CVE-2026-19666\n   * SECURITY UPDATE: crash on wildcard answers carrying both NSEC and NSEC3\n     proofs\n     - debian/patches/CVE-2026-80274.patch: record the denial type the\n       validator accepted and use it when caching and serving the NOQNAME\n       proof in lib/dns/validator.c, lib/dns/resolver.c and\n       lib/dns/rdatalist.c; adds dns_rdataset_addnoqnametype() so\n       dns_rdataset_addnoqname() keeps its signature.\n     - CVE-2026-80274\n   * Add root KSK-2024 (key tag 38696) trust anchor to bind.keys; fresh\n     installs could not validate the root zone after the 2026-10-11 rollover\n     - debian/patches/update_keys.patch: add the 38696 initial-key to\n       bind.keys and the generated bind.keys.h next to the existing 20326\n       entry (upstream 609bf35075, carried as initial-key because 9.10 has no\n       initial-ds).","modified":"2026-10-26T09:32:03.018030406Z","published":"2026-10-15T16:53:16Z","upstream":["CVE-2026-13321","CVE-2026-19666","CVE-2026-80274"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792083184.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13321"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19666"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80274"}],"affected":[{"package":{"name":"bind9","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/bind9?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"bind9-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/bind9-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"bind9-host","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/bind9-host?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"bind9utils","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/bind9utils?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"dnsutils","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/dnsutils?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"host","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/host?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libbind-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libbind-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libbind-export-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libbind-export-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libbind9-140","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libbind9-140?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libdns-export162","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libdns-export162?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libdns162","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libdns162?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libirs-export141","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libirs-export141?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libirs141","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libirs141?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisc-export160","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisc-export160?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisc160","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisc160?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisccc-export140","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisccc-export140?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisccc140","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisccc140?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisccfg-export140","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisccfg-export140?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"libisccfg140","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libisccfg140?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"liblwres141","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/liblwres141?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}},{"package":{"name":"lwresd","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/lwresd?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.10.3.dfsg.P4-8ubuntu1.19+tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1792083184.json"}}],"schema_version":"1.9.0"}