[El-errata] ELSA-2026-54654 Important: Oracle Linux 8 bind security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-54654

http://linux.oracle.com/errata/ELSA-2026-54654.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bind-9.11.36-16.el8_10.14.x86_64.rpm
bind-chroot-9.11.36-16.el8_10.14.x86_64.rpm
bind-devel-9.11.36-16.el8_10.14.i686.rpm
bind-devel-9.11.36-16.el8_10.14.x86_64.rpm
bind-export-devel-9.11.36-16.el8_10.14.i686.rpm
bind-export-devel-9.11.36-16.el8_10.14.x86_64.rpm
bind-export-libs-9.11.36-16.el8_10.14.i686.rpm
bind-export-libs-9.11.36-16.el8_10.14.x86_64.rpm
bind-libs-9.11.36-16.el8_10.14.i686.rpm
bind-libs-9.11.36-16.el8_10.14.x86_64.rpm
bind-libs-lite-9.11.36-16.el8_10.14.i686.rpm
bind-libs-lite-9.11.36-16.el8_10.14.x86_64.rpm
bind-license-9.11.36-16.el8_10.14.noarch.rpm
bind-lite-devel-9.11.36-16.el8_10.14.i686.rpm
bind-lite-devel-9.11.36-16.el8_10.14.x86_64.rpm
bind-pkcs11-9.11.36-16.el8_10.14.x86_64.rpm
bind-pkcs11-devel-9.11.36-16.el8_10.14.i686.rpm
bind-pkcs11-devel-9.11.36-16.el8_10.14.x86_64.rpm
bind-pkcs11-libs-9.11.36-16.el8_10.14.i686.rpm
bind-pkcs11-libs-9.11.36-16.el8_10.14.x86_64.rpm
bind-pkcs11-utils-9.11.36-16.el8_10.14.x86_64.rpm
bind-sdb-9.11.36-16.el8_10.14.x86_64.rpm
bind-sdb-chroot-9.11.36-16.el8_10.14.x86_64.rpm
bind-utils-9.11.36-16.el8_10.14.x86_64.rpm
python3-bind-9.11.36-16.el8_10.14.noarch.rpm

aarch64:
bind-9.11.36-16.el8_10.14.aarch64.rpm
bind-chroot-9.11.36-16.el8_10.14.aarch64.rpm
bind-devel-9.11.36-16.el8_10.14.aarch64.rpm
bind-export-devel-9.11.36-16.el8_10.14.aarch64.rpm
bind-export-libs-9.11.36-16.el8_10.14.aarch64.rpm
bind-libs-9.11.36-16.el8_10.14.aarch64.rpm
bind-libs-lite-9.11.36-16.el8_10.14.aarch64.rpm
bind-license-9.11.36-16.el8_10.14.noarch.rpm
bind-lite-devel-9.11.36-16.el8_10.14.aarch64.rpm
bind-pkcs11-9.11.36-16.el8_10.14.aarch64.rpm
bind-pkcs11-devel-9.11.36-16.el8_10.14.aarch64.rpm
bind-pkcs11-libs-9.11.36-16.el8_10.14.aarch64.rpm
bind-pkcs11-utils-9.11.36-16.el8_10.14.aarch64.rpm
bind-sdb-9.11.36-16.el8_10.14.aarch64.rpm
bind-sdb-chroot-9.11.36-16.el8_10.14.aarch64.rpm
bind-utils-9.11.36-16.el8_10.14.aarch64.rpm
python3-bind-9.11.36-16.el8_10.14.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/bind-9.11.36-16.el8_10.14.src.rpm

Related CVEs:

CVE-2026-10723
CVE-2026-11622
CVE-2026-11721
CVE-2026-13204
CVE-2026-13321




Description of changes:

[32:9.11.36-16.14]
- Validate NSEC3 signer matches owning zone (CVE-2026-10723)

[32:9.11.36-16.12]
- Prevent accepting unsigned NSEC/NSEC3 records (CVE-2026-13204)

[32:9.11.36-16.11]
- Reject out-of-zone NSEC entries in DNSSEC validation
  (CVE-2026-13321)

[32:9.11.36-16.10]
- Reject RRSIG records with invalid label counts (CVE-2026-11721)
- Add unittest check

[32:9.11.36-16.9]
- Add reference counting to cache dns_slabheaders (CVE-2026-11622)