The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55441 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1555:03 advisory.

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
      * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
      * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
      * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
      * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
      * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57189 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

    * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)

    * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

    * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)

    * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)

    * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)

    * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1671:05 advisory.

    * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
      * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
      * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
      * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
      * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
      * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0925 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-10723:
    BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge     authenticated NXDOMAIN responses.
    This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11331:
    An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query     names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled     correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9     software.
    This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11622:
    A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can     suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver     can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured     in the max-cache-size parameter.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-11721:
    It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of     labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a     zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to     have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13204:
    If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

    CVE-2026-13321:
    The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside     the signer's zone.
    This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23,     9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1785309449 advisory.

  - If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist     an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating     this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0     through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. (CVE-2026-13204)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
335921	RHEL 9 : bind (RHSA-2026:55441)	Nessus	Red Hat Local Security Checks	2026/8/17	2026/8/17	high
337120	MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.12 (AXSA:2026-1555:03)	Nessus	Miracle Linux Local Security Checks	2026/8/18	2026/8/18	high
338211	RHEL 9 : bind (RHSA-2026:57189)	Nessus	Red Hat Local Security Checks	2026/8/20	2026/8/20	high
341010	MiracleLinux 9 : bind9.18-9.18.29-14.el9_8.8 (AXSA:2026-1671:05)	Nessus	Miracle Linux Local Security Checks	2026/8/27	2026/8/27	high
341136	TencentOS Server 3: bind9.16 (TSSA-2026:0925)	Nessus	Tencent Local Security Checks	2026/8/27	2026/8/27	high
352386	CentOS Linux 8 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS-STREAM8:CLSA-2026:1785309449)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high

検出

プラグインの検索

high

high

high

high

high

high