CVE-2026-75029 is a medium severity vulnerability in ISC BIND 9 that allows an attacker to cause asymmetric resource consumption via amplification. By sending multiple copies of a record that should only exist once in a query response, such as an SOA record with identical RDATA, the BIND server appends these to the in-memory RDATA set. This behavior increases memory usage of the negative cache and may lead to other memory-related attack vectors. The vulnerability affects multiple BIND 9 versions from 9.11.0 through 9.21.25 and their respective S1 variants.
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-81736 is a high-severity vulnerability in ISC BIND 9 that causes excessive CPU consumption when a resolver with cached SVCB/HTTPS AliasMode records is queried for the root of that tree. This affects multiple BIND 9 versions including 9.18.x, 9.20.x, 9.21.x, and their respective S1 variants. The issue results in disproportionate CPU usage during response construction, potentially leading to denial of service conditions.
CVE-2026-19667 is a numeric truncation error vulnerability in ISC BIND 9's named DNS service. An attacker-controlled authoritative DNS server can send a crafted negative response of exactly 65536 bytes, causing named to create a zero-byte negative cache entry. Subsequent accesses to this cache entry cause the named service to abort, resulting in a denial of service. This affects multiple BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants.
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-19662 is a use-after-free vulnerability in ISC BIND 9 that can cause the named DNS resolver to abort. The issue arises when the resolver sends multiple queries for a DNSSEC-signed zone controlled by an attacker, who responds with a crafted sequence of answers arriving in a specific order and timing. This vulnerability affects multiple BIND 9 versions from 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and their respective S1 variants. The CVSS score is 5.9, indicating medium severity, with an impact on availability but no confidentiality or integrity loss. No known exploits are reported in the wild, and no patch information is provided in the input data.
CVE-2026-81563 is a high-severity vulnerability in ISC BIND 9 that causes a memory management issue when processing certain DNS records. Specifically, a BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly release internal resources. Repeated occurrences can lead to resource exhaustion, preventing new recursive DNS lookups. This affects multiple BIND 9 versions including 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and several S1 variants. The vulnerability has a CVSS score of 7.5, indicating high severity due to its impact on availability. No known exploits are reported in the wild. No patch or remediation details are provided in the input data.
CVE-2026-78301 is a vulnerability in ISC BIND 9 where a malformed zone containing an NS or DNAME node above its origin is treated as a zone cut by the named server. This causes queries within the configured zone to lose authoritative status and return out-of-zone delegations. On servers that also provide recursion, BIND can follow this locally sourced cut and cache attacker-supplied data affecting names outside the configured zone. The issue persists as long as the malformed zone remains in the zone database. This affects multiple BIND 9 versions from 9.11.0 through 9.21.25 and related S1 versions.
CVE-2026-77692 is a high-severity vulnerability in ISC BIND 9 that causes the DNS server process 'named' to abort when processing a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by premature connection closure. This results in a denial of service condition without impacting confidentiality or integrity.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.
This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion (OOM). In httpserver.cpp, the HttpServer::Request::content function reads the Content-Length header and directly passes this value to std::string::resize() without any upper-bound validation or safe parsing. An attacker can send an HTTP POST request with an artificially large Content-Length value. This forces the daemon to attempt allocating gigabytes of memory, resulting in a std::bad_alloc exception and immediately crashing the AirSane process. Additionally, providing non-numeric characters in the Content-Length header leads to undefined behavior (NaN to integer conversion) due to the lack of error handling during header parsing. Version 0.4.12 patches the issue.
CVE-2026-20293 is a high-severity vulnerability in the UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances. It allows an authenticated user with user or admin roles, or an unauthenticated attacker with physical access, to bypass UEFI Secure Boot validation by exploiting memory write commands available in the UEFI Shell. This enables unauthorized software execution by manipulating UEFI memory variables during boot. The vulnerability affects multiple specific versions of Cisco Enterprise NFV Infrastructure Software.