IBM Support

Security Bulletin: Multiple vulnerabilities impact AIX due to ISC BIND

Security Bulletin


Summary

Vulnerabilities in ISC BIND: (DNSSEC Validation /Integrity Bypass : CVE-2026-19033, CVE-2026-19941, CVE-2026-77119), (Resolver Crash / Denial of Service : CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-80274), (Resource Exhaustion CPU/Memory : CVE-2026-19668, CVE-2026-75029, CVE-2026-81563, CVE-2026-81736). AIX uses ISC BIND as as part of its DNS functions.

Vulnerability Details

CVEID:   CVE-2026-19033
DESCRIPTION:   For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
CVSS Source:   security-officer@isc.org
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L)

CVEID:   CVE-2026-19662
DESCRIPTION:   An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-416: Use After Free
CVSS Source:   security-officer@isc.org
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-19666
DESCRIPTION:   On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-416: Use After Free
CVSS Source:   security-officer@isc.org
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-19667
DESCRIPTION:   If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-197: Numeric Truncation Error
CVSS Source:   security-officer@isc.org
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-19668
DESCRIPTION:   A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-407: Inefficient Algorithmic Complexity
CVSS Source:   security-officer@isc.org
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2026-19941
DESCRIPTION:   An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-345: Insufficient Verification of Data Authenticity
CVSS Source:   security-officer@isc.org
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:   CVE-2026-75029
DESCRIPTION:   In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-405: Asymmetric Resource Consumption (Amplification)
CVSS Source:   security-officer@isc.org
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2026-77119
DESCRIPTION:   A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-346: Origin Validation Error
CVSS Source:   security-officer@isc.org
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

CVEID:   CVE-2026-80274
DESCRIPTION:   If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-617: Reachable Assertion
CVSS Source:   security-officer@isc.org
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-81563
DESCRIPTION:   A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-401: Missing Release of Memory after Effective Lifetime
CVSS Source:   security-officer@isc.org
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:   CVE-2026-81736
DESCRIPTION:   If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CWE:   CWE-1050: Excessive Platform Resource Consumption within a Loop
CVSS Source:   security-officer@isc.org
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)Version(s)
AIX7.2
AIX7.3
VIOS4.1

 

 The vulnerabilities are being addressed for the following filesets:

 key_fileset = aix

FilesetLower LevelUpper Level KEY
bind.rte 7.1.916.07.1.916.4800key_w_fs
bind.rte 7.2.916.07.2.916.4801key_w_fs
bind.rte 7.2.918.07.2.918.4900key_w_fs
bind.rte 7.3.916.07.3.916.4800key_w_fs
bind.rte 7.3.918.07.3.918.4900key_w_fs
bind.rte 7.3.920.26007.3.920.2600key_w_fs

 

Note:

A. Latest level of BIND fileset is available from the web download site:

https://www.ibm.com/resources/mrs/assets?source=aixbp

 

To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user's guide.

Example:  lslpp -L | grep -i bind.rte

Remediation/Fixes

A. FIXES

IBM strongly recommends addressing the vulnerability now.

The AIX and VIOS fixes can be downloaded via https from:

https://aix.software.ibm.com/aix/efixes/security/bind_fix32.tar

 

The fileset update has a dependency on OpenSSL 3.0. OpenSSL 3.0 may be downloaded from:

https://www.ibm.com/resources/mrs/assets?source=aixbp

 

The link above is to a tar file containing this signed advisory, install packages, and OpenSSL signatures for each package. The fixes below include prerequisite checking. This will enforce the correct mapping between the fixes and AIX Technology Levels.

 

To extract the fixes from the tar file:

tar xvf bind_fix32.tar

 

For AIX 7.2 (requires OpenSSL 3.0):

tar xvf bind_fix32/72bind920.tar

 

For AIX 7.3 and VIOS 4.1:

tar xvf bind_fix32/73bind920.tar

 

IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

 

To preview the fix installation:

installp -apYd . bind

 

To install the fix package:

installp -aXYd . bind

 

Verify you have retrieved the fixes intact:

The checksums below were generated using the following command

"openssl dgst -sha256 [file]" 

openssl dgst -sha256 filenameKEY

b9a302c14bcc398d78edae588b7d01ea7837eddbec022da482f9513b4ae457a0

72bind.rtekey_w_csum

74b0af640a57f975077fc3f024fb2f5c914e52f1b522e65b1973bdc0fef58a94

73bind.rtekey_w_csum

 

openssl dgst -sha512 filenameKEY

963bfa32d8547a0fe83599baea65ca9f6dd5bb14871e5ebaea6e9a0bc1b5b829c2e6129aa11dad670e5884792162e984ca939e2e4b792eb3d52b60545ec3048b

72bind.rtekey_4K_w_csum

ea56e28ae86f9bb46d8e9f7f66e8a5afa266e176815617625fa671868e3100a020d2f9677ba7246035e494d49424e1613033d122d11c1930d0d6c2350d34a312

73bind.rtekey_4K_w_csum

 

These sums should match exactly. The OpenSSL signatures in the tar file and on this advisory can also be used to verify the integrity of the fixes.  If the sums or signatures cannot be confirmed, contact IBM Support at http://ibm.com/support/ and describe the discrepancy.

openssl dgst -sha256 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]

openssl dgst -sha256 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

 

Published advisory OpenSSL signature file location:

https://aix.software.ibm.com/aix/efixes/security/bind_advisory32.asc.sig

 

B. FIX AND INTERIM FIX INSTALLATION

If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

 

To preview a fix installation:

installp -a -d fix_name -p all  # where fix_name is the name of the

                                            # fix package being previewed.

To install a fix package:

installp -a -d fix_name -X all  # where fix_name is the name of the

                                            # fix package being installed.

 

Interim fixes have had limited functional and regression testing but not the full regression testing that takes place for Service Packs; however, IBM does fully support them.

 

Interim fix management documentation can be found at:

https://www.ibm.com/support/pages/managing-interim-fixes-aix

 

To preview an interim fix installation:

emgr -e ipkg_name -p         # where ipkg_name is the name of the

                                         # interim fix package being previewed.

 

To install an interim fix package:

emgr -e ipkg_name -X         # where ipkg_name is the name of the

                                         # interim fix package being installed.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

Change History

02 Nov 2026: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"Component":"","Platform":[{"code":"PF002","label":"AIX"}],"Version":"7.2, 7.3","Edition":"","Line of Business":{"code":"LOB08","label":"Cognitive Systems"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSPHKW","label":"PowerVM Virtual I\/O Server"},"Component":"","Platform":[{"code":"PF002","label":"AIX"}],"Version":"4.1","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]

Document Information

Modified date:
02 November 2026

Initial Publish date:
02 November 2026

UID

ibm17294990

Page Feedback