ALAS2-2026-4001

Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4001
Advisory Released Date: 2026-10-14
Advisory Updated Date: 2026-10-14
Severity: Important
Issue Overview:

Amazon Linux–vended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled, this could result in DNS resolution failures, including for names in unsigned zones. This applies where the resolver is still using the trust anchor shipped in the package; resolvers that already picked up the new root key via RFC 5011 are unaffected.

On 11 October 2026 at 14:00 UTC the DNS root zone began signing with KSK-2024 (key tag 38696), replacing KSK-2017 (key tag 20326). The packaged trust anchor files contained only KSK-2017, so an affected resolver cannot validate the root DNSKEY RRset and returns SERVFAIL.

The updated packages include an updated root signing key.


Affected Packages:

bind


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update bind or yum update --advisory ALAS2-2026-4001 to update your system.

New Packages:
aarch64:
    bind-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-pkcs11-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-sdb-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-libs-lite-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-libs-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-utils-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-devel-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-lite-devel-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-chroot-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-export-libs-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-export-devel-9.11.4-26.P2.amzn2.13.19.aarch64
    bind-debuginfo-9.11.4-26.P2.amzn2.13.19.aarch64

i686:
    bind-9.11.4-26.P2.amzn2.13.19.i686
    bind-pkcs11-9.11.4-26.P2.amzn2.13.19.i686
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.19.i686
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.19.i686
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.19.i686
    bind-sdb-9.11.4-26.P2.amzn2.13.19.i686
    bind-libs-lite-9.11.4-26.P2.amzn2.13.19.i686
    bind-libs-9.11.4-26.P2.amzn2.13.19.i686
    bind-utils-9.11.4-26.P2.amzn2.13.19.i686
    bind-devel-9.11.4-26.P2.amzn2.13.19.i686
    bind-lite-devel-9.11.4-26.P2.amzn2.13.19.i686
    bind-chroot-9.11.4-26.P2.amzn2.13.19.i686
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.19.i686
    bind-export-libs-9.11.4-26.P2.amzn2.13.19.i686
    bind-export-devel-9.11.4-26.P2.amzn2.13.19.i686
    bind-debuginfo-9.11.4-26.P2.amzn2.13.19.i686

noarch:
    bind-license-9.11.4-26.P2.amzn2.13.19.noarch

src:
    bind-9.11.4-26.P2.amzn2.13.19.src

x86_64:
    bind-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-pkcs11-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-pkcs11-utils-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-pkcs11-libs-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-pkcs11-devel-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-sdb-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-libs-lite-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-libs-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-utils-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-devel-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-lite-devel-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-chroot-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-sdb-chroot-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-export-libs-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-export-devel-9.11.4-26.P2.amzn2.13.19.x86_64
    bind-debuginfo-9.11.4-26.P2.amzn2.13.19.x86_64

Additional References

Red Hat: 

Mitre: