Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ openSUSE-SU-2026:20039-1 — bind (CVE-2025-40778 +2 more)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for bind

This update for bind fixes the following issues:

  • Upgrade to release 9.20.15

Security Fixes:

  • CVE-2025-40778: Fixed cache poisoning attacks with unsolicited RRs (bsc#1252379)
  • CVE-2025-40780: Fixed cache poisoning due to weak PRNG (bsc#1252380)
  • CVE-2025-8677: Fixed resource exhaustion via malformed DNSKEY handling (bsc#1252378)

New Features:

  • Add dnssec-policy keys configuration check to named-checkconf.
  • Add a new option manual-mode to dnssec-policy.
  • Add a new option servfail-until-ready to response-policy

zones.

  • Support for parsing HHIT and BRID records has been added.
  • Support for parsing DSYNC records has been added.

Removed Features:

  • Deprecate the tkey-gssapi-credential statement.
  • Obsolete the tkey-domain statement.

Feature Changes:

  • Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS

digest type 1.

Bug Fixes:

  • Missing DNSSEC information when CD bit is set in query.
  • rndc sign during ZSK rollover will now replace signatures.
  • Use signer name when disabling DNSSEC algorithms.
  • Preserve cache when reload fails and reload the server again.
  • Prevent spurious SERVFAILs for certain 0-TTL resource records.
  • Fix unexpected termination if catalog-zones had undefined

default-primaries.

  • Stale RRsets in a CNAME chain were not always refreshed.
  • Add RPZ extended DNS error for zones with a CNAME override

policy configured.

  • Fix dig +keepopen option.
  • Log dropped or slipped responses in the query-errors category.
  • Fix synth-from-dnssec not working in some scenarios.
  • Clean enough memory when adding new ADB names/entries under

memory pressure.

  • Prevent spurious validation failures.
  • Ensure file descriptors 0-2 are in use before using libuv

[bsc#1230649]

Affected software

openSUSE-SU-2026:20039-1 is recorded against 1 package.

  • bind (fixed in 9.20.15-160000.1.1)

Timeline and source

Published on 15 January 2026 and last revised on 23 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-01-15
Updated 2026-08-20
Modified 2026-03-23
Fix URL N/A

Affected Packages

Software From version Fixed in
bind 9.20.15-160000.1.1

Free Vulnerability Check

Is your site affected by openSUSE-SU-2026:20039-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2026:20039-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.