Threat Intelligence Database

For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVE-2026-80274 is a high-severity vulnerability in ISC BIND 9 that causes a denial of service. The issue arises when a BIND resolver queries a DNSSEC-signed authoritative zone and receives a specific sequence of DNS responses, including a valid wildcard answer with signed NSEC3 proof followed by an unsigned NSEC at the same owner name. This triggers a reachable assertion failure, causing the program to exit unexpectedly.

CVE-2026-77119 is a medium severity vulnerability in ISC BIND 9 involving an origin validation error. The flaw allows a validly signed NSEC3 record from an unrelated sibling zone to be incorrectly accepted as proof of insecurity. This can downgrade a secure delegation and permit acceptance of a forged unsigned DNS answer. The vulnerability affects multiple versions of BIND 9 ranging from 9.11.0 through 9.21.25, including some S1 variants.

CVE-2026-76163 is a reachable assertion vulnerability in ISC BIND 9 that can cause the DNS server to crash unexpectedly. The issue arises when BIND is configured without a global options block in the named.conf file and receives a DNS query of type TKEY. This vulnerability affects specific versions of BIND 9 and results in denial of service due to program exit. It has a high severity score of 7.5.

CVE-2026-75029 is a medium severity vulnerability in ISC BIND 9 that allows an attacker to cause asymmetric resource consumption via amplification. By sending multiple copies of a record that should only exist once in a query response, such as an SOA record with identical RDATA, the BIND server appends these to the in-memory RDATA set. This behavior increases memory usage of the negative cache and may lead to other memory-related attack vectors. The vulnerability affects multiple BIND 9 versions from 9.11.0 through 9.21.25 and their respective S1 variants.

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVE-2026-81736 is a high-severity vulnerability in ISC BIND 9 that causes excessive CPU consumption when a resolver with cached SVCB/HTTPS AliasMode records is queried for the root of that tree. This affects multiple BIND 9 versions including 9.18.x, 9.20.x, 9.21.x, and their respective S1 variants. The issue results in disproportionate CPU usage during response construction, potentially leading to denial of service conditions.

CVE-2026-19667 is a numeric truncation error vulnerability in ISC BIND 9's named DNS service. An attacker-controlled authoritative DNS server can send a crafted negative response of exactly 65536 bytes, causing named to create a zero-byte negative cache entry. Subsequent accesses to this cache entry cause the named service to abort, resulting in a denial of service. This affects multiple BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and their S1 variants.

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.