CVE-2026-19033: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data in ISC BIND 9
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AI Analysis
Technical Summary
The vulnerability arises because BIND 9's `named` process, when handling a secondary zone with TSIG-restricted transfers, may prematurely serve zone data received during a multi-message TCP IXFR transfer before the final TSIG signature message is received and validated. If the final TSIG signature never arrives, `named` does not revert to the pre-transfer state, potentially allowing an attacker who does not possess a valid TSIG signature to inject unauthorized zone data. This affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants as specified.
Potential Impact
An attacker can send unauthorized zone data to a secondary DNS server during a multi-message TCP IXFR transfer without possessing a valid TSIG signature. This could lead to the secondary server serving incorrect or malicious DNS data, impacting DNS integrity. There is no confidentiality impact, but integrity is compromised, and availability impact is low.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should consider restricting or monitoring IXFR transfers or using alternative secure zone transfer methods. No vendor advisory or patch links are provided in the current data.
CVE-2026-19033: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data in ISC BIND 9
Description
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CVSS v3.1
Score 6.5medium
Affected software
ISC
BIND 9
pkg:github/isc/bind9Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because BIND 9's `named` process, when handling a secondary zone with TSIG-restricted transfers, may prematurely serve zone data received during a multi-message TCP IXFR transfer before the final TSIG signature message is received and validated. If the final TSIG signature never arrives, `named` does not revert to the pre-transfer state, potentially allowing an attacker who does not possess a valid TSIG signature to inject unauthorized zone data. This affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants as specified.
Potential Impact
An attacker can send unauthorized zone data to a secondary DNS server during a multi-message TCP IXFR transfer without possessing a valid TSIG signature. This could lead to the secondary server serving incorrect or malicious DNS data, impacting DNS integrity. There is no confidentiality impact, but integrity is compromised, and availability impact is low.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, administrators should consider restricting or monitoring IXFR transfers or using alternative secure zone transfer methods. No vendor advisory or patch links are provided in the current data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- isc
- Date Reserved
- 2026-08-06T04:18:09.842Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaaa87255bf5e2cf5bb9886
Added to database: 09/16/2026, 14:32:18 UTC
Last enriched: 09/16/2026, 14:47:21 UTC
Last updated: 09/17/2026, 03:24:51 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.