Linux · Amazon Linux · Security advisory · September 28, 2026

ALAS2023-2026-3137: Security update for 13 packages

ALAS2023-2026-3137, released September 28, 2026, fixes 10 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Highest CVSS
8.1
Base score, 0 to 10
Highest EPSS
0.0057
47th percentile

Priority of the 10 CVEs

Patch now 0 Urgent 0 High 6 Routine 4

Fixed package versions

ProductReleaseFixed in
bindamzn 202332:9.18.50-1.amzn2023.0.3
bind-chrootamzn 202332:9.18.50-1.amzn2023.0.3
bind-debuginfoamzn 202332:9.18.50-1.amzn2023.0.3
bind-debugsourceamzn 202332:9.18.50-1.amzn2023.0.3
bind-develamzn 202332:9.18.50-1.amzn2023.0.3
bind-dnssec-utilsamzn 202332:9.18.50-1.amzn2023.0.3
bind-dnssec-utils-debuginfoamzn 202332:9.18.50-1.amzn2023.0.3
bind-docamzn 202332:9.18.50-1.amzn2023.0.3
bind-libsamzn 202332:9.18.50-1.amzn2023.0.3
bind-libs-debuginfoamzn 202332:9.18.50-1.amzn2023.0.3
bind-licenseamzn 202332:9.18.50-1.amzn2023.0.3
bind-utilsamzn 202332:9.18.50-1.amzn2023.0.3
bind-utils-debuginfoamzn 202332:9.18.50-1.amzn2023.0.3

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-19666 Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path7.5 0.0057 None reported
High CVE-2026-19667 Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`7.5 0.0057 None reported
High CVE-2026-80274 Validating resolver can abort while caching a mismatched NOQNAME proof7.5 0.0057 None reported
High CVE-2026-81563 SVCB AliasMode additional-data error leaks qpcache references7.5 0.0057 None reported
High CVE-2026-81736 bind9: If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree,...7.5 0.0057 None reported
High CVE-2026-19662 qpcache NOQNAME proof use-after-free crashes recursive resolver8.1 0.0046 None reported
Routine CVE-2026-75029 libdns-export1100: In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an...5.3 0.0048 None reported
Routine CVE-2026-19033 bind9: For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transf...6.5 0.0024 None reported
Routine CVE-2026-19941 checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof5.9 0.0023 None reported
Routine CVE-2026-78301 Out-of-zone database nodes can become authoritative zone cuts5.8 0.0021 None reported
Showing 1 to 10 of 10 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.