{"id":"CLSA-2026-1792089817","summary":"Fix CVE(s): CVE-2026-13321, CVE-2026-19666, CVE-2026-80274","details":"   * SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC\n     Next Domain Name\n     - debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose next\n       owner name is not a subdomain of the RRSIG signer name in\n       dns_dnssec_verify3() in lib/dns/dnssec.c.\n     - CVE-2026-13321\n   * SECURITY UPDATE: assertion failure with dns64 and break-dnssec\n     - debian/patches/CVE-2026-19666.patch: clear the noqname alias on the\n       DNS64 filter64 path in query_find() in bin/named/query.c.\n     - CVE-2026-19666\n   * SECURITY UPDATE: crash on wildcard answers carrying both NSEC and NSEC3\n     proofs\n     - debian/patches/CVE-2026-80274.patch: record the denial type the\n       validator accepted and use it when caching and serving the NOQNAME\n       proof in lib/dns/validator.c, lib/dns/resolver.c and\n       lib/dns/rdatalist.c; adds dns_rdataset_addnoqnametype() so\n       dns_rdataset_addnoqname() keeps its signature.\n     - debian/libdns1100.symbols: add dns_rdataset_addnoqnametype.\n     - CVE-2026-80274\n   * Add root KSK-2024 (key tag 38696) trust anchor to bind.keys; fresh\n     installs could not validate the root zone after the 2026-10-11 rollover\n     - debian/patches/update-root-ksk-38696.patch: add the 38696 initial-key\n       to bind.keys and the generated bind.keys.h (upstream 609bf35075,\n       carried as initial-key because 9.11 has no initial-ds).","modified":"2026-10-26T09:32:04.778613811Z","published":"2026-10-15T18:43:49Z","upstream":["CVE-2026-13321","CVE-2026-19666","CVE-2026-80274"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792089817.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13321"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19666"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80274"}],"affected":[{"package":{"name":"bind9","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/bind9?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"bind9-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/bind9-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"bind9-host","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/bind9-host?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"bind9utils","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/bind9utils?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"dnsutils","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/dnsutils?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libbind-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libbind-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libbind-export-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libbind-export-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libbind9-160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libbind9-160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libdns-export1100","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libdns-export1100?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libdns1100","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libdns1100?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libirs-export160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libirs-export160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libirs160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libirs160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisc-export169","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisc-export169?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisc169","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisc169?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisccc-export160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisccc-export160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisccc160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisccc160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisccfg-export160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisccfg-export160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"libisccfg160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libisccfg160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}},{"package":{"name":"liblwres160","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/liblwres160?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.11.3+dfsg-1ubuntu1.18+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792089817.json"}}],"schema_version":"1.9.0"}