IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
5.9Media

CVE-2026-19662qpcache NOQNAME proof use-after-free crashes recursive resolver

ISC BIND 9 Publicada: (hace 1 mes)

Descripción

An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Debilidad (CWE): CWE-416

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
isc bind 9.11.0 – ≤ 9.18.50
ISC BIND 9 9.11.0 – ≤ 9.18.50, 9.20.0 – ≤ 9.20.27, 9.11.3-S1 – ≤ 9.18.50-S1, 9.20.9-S1 – ≤ 9.20.27-S1

Correcciones de Ubuntu

  • USN-8969-1 Bind vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 03.11.2026 · bind9

Referencias y parches

CVE recientes del mismo producto — Ubuntu 22.04 LTS

7.7Alta
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.8Alta
CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.