<div class="container">
<h1>Security update for bind</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22198-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-06-20T06:54:39Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265591">bsc#1265591</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265592">bsc#1265592</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265593">bsc#1265593</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265594">bsc#1265594</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265595">bsc#1265595</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265596">bsc#1265596</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3039.html">CVE-2026-3039</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3592.html">CVE-2026-3592</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-3593.html">CVE-2026-3593</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-5946.html">CVE-2026-5946</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-5947.html">CVE-2026-5947</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-5950.html">CVE-2026-5950</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3039</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3039</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3592</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3592</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3593</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3593</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-3593</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5946</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5946</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5947</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5947</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5947</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5950</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-5950</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves six vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for bind fixes the following issues</p>
<p>Upgrade to release 9.20.23:</p>
<ul>
<li>CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).</li>
<li>CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).</li>
<li>CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).</li>
<li>CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).</li>
<li>CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).</li>
<li>CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-988=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-988=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>bind-modules-ldap-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-mysql-9.20.23-160000.1.1</li>
<li>bind-modules-sqlite3-9.20.23-160000.1.1</li>
<li>bind-modules-generic-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-perl-debuginfo-9.20.23-160000.1.1</li>
<li>bind-utils-9.20.23-160000.1.1</li>
<li>bind-modules-mysql-debuginfo-9.20.23-160000.1.1</li>
<li>bind-debugsource-9.20.23-160000.1.1</li>
<li>bind-9.20.23-160000.1.1</li>
<li>bind-modules-ldap-9.20.23-160000.1.1</li>
<li>bind-modules-generic-9.20.23-160000.1.1</li>
<li>bind-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-sqlite3-debuginfo-9.20.23-160000.1.1</li>
<li>bind-utils-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-perl-9.20.23-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>bind-doc-9.20.23-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>bind-modules-ldap-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-mysql-9.20.23-160000.1.1</li>
<li>bind-modules-sqlite3-9.20.23-160000.1.1</li>
<li>bind-modules-generic-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-perl-debuginfo-9.20.23-160000.1.1</li>
<li>bind-utils-9.20.23-160000.1.1</li>
<li>bind-modules-mysql-debuginfo-9.20.23-160000.1.1</li>
<li>bind-debugsource-9.20.23-160000.1.1</li>
<li>bind-9.20.23-160000.1.1</li>
<li>bind-modules-ldap-9.20.23-160000.1.1</li>
<li>bind-modules-generic-9.20.23-160000.1.1</li>
<li>bind-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-sqlite3-debuginfo-9.20.23-160000.1.1</li>
<li>bind-utils-debuginfo-9.20.23-160000.1.1</li>
<li>bind-modules-perl-9.20.23-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>bind-doc-9.20.23-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3039.html">https://www.suse.com/security/cve/CVE-2026-3039.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3592.html">https://www.suse.com/security/cve/CVE-2026-3592.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-3593.html">https://www.suse.com/security/cve/CVE-2026-3593.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-5946.html">https://www.suse.com/security/cve/CVE-2026-5946.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-5947.html">https://www.suse.com/security/cve/CVE-2026-5947.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-5950.html">https://www.suse.com/security/cve/CVE-2026-5950.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265591">https://bugzilla.suse.com/show_bug.cgi?id=1265591</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265592">https://bugzilla.suse.com/show_bug.cgi?id=1265592</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265593">https://bugzilla.suse.com/show_bug.cgi?id=1265593</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265594">https://bugzilla.suse.com/show_bug.cgi?id=1265594</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265595">https://bugzilla.suse.com/show_bug.cgi?id=1265595</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265596">https://bugzilla.suse.com/show_bug.cgi?id=1265596</a>
</li>
</ul>
</div>