BSD Portsbind920 -- multiple vulnerabilities
· CVE-2026-19668, CVE-2026-19033, CVE-2026-77119, CVE-2026-19941, CVE-2026-19666, CVE-2026-19667, CVE-2026-19662, CVE-2026-75029, CVE-2026-77692, CVE-2026-81736, CVE-2026-76163, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563 · VuXML entry
ISC team reports: CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof CVE-2026-19666: Use-after-free in …
Affected versions
- bind920 < 9.20.29
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | dns/bind920 | 9.20.30 | fixed | (17 days after) |
| MidnightBSD | dns/bind920 | 9.20.30 | out of range, by version | |
| DragonFly | dns/bind920 | 9.20.10 | vulnerable since 2026-10-04 |