Skip to main content

Bind 9 CVE-2026-3119

| EUVDEUVD-2026-15411 MEDIUM
Reachable Assertion (CWE-617)
2026-03-25 isc GHSA-rrrp-782c-4484
Denial Of Service Bind 9
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
EUVD ID Assigned
Mar 25, 2026 - 14:00 euvd
EUVD-2026-15411
Analysis Generated
Mar 25, 2026 - 14:00 vuln.today
Patch released
Mar 25, 2026 - 14:00 nvd
Patch available
CVE Published
Mar 25, 2026 - 13:31 nvd
MEDIUM 6.5

DescriptionCVE.org

Under certain conditions, named may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the named configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

AnalysisAI

BIND 9 DNS server crashes when processing specially crafted TSIG-authenticated queries containing TKEY records, affecting versions 9.20.0-9.20.20, 9.21.0-9.21.19, and 9.20.9-S1-9.20.20-S1 on Ubuntu, SUSE, and Debian systems. An authenticated attacker with a valid TSIG key can trigger a denial of service by sending a malformed query, disrupting DNS resolution services. A patch is available for affected installations.

Technical ContextAI

BIND 9 (Berkeley Internet Name Domain) is the de facto standard open-source DNS server software, identified via CPE cpe:2.3:a:isc:bind_9. The vulnerability involves the handling of TKEY (Transaction Key) resource records and TSIG (Transaction Signature) authentication mechanisms, both defined in RFC 2930 and RFC 2845 respectively. TSIG enables DNS clients and servers to authenticate DNS transactions using shared secrets, and TKEY is used to establish such keys dynamically. The underlying issue is classified as CWE-617 (Reachable Assertion), indicating the code path contains an assertion that can be triggered by specially crafted but valid input, leading to abnormal termination. The vulnerability only manifests when processing an incoming request that has already passed TSIG validation, meaning the attacker must possess a valid TSIG key configured on the target named instance.

RemediationAI

Immediately upgrade BIND 9 to version 9.20.21, 9.21.20, or later (or corresponding Security Release versions if deployed). Download patches from ISC at https://downloads.isc.org/isc/bind9/ and follow ISC's upgrade procedures for your platform. Until patches can be applied, implement network-level mitigations: restrict TSIG key usage to specific, trusted clients by configuring tight ACLs (access control lists) in named.conf; audit all configured TSIG keys and rotate any with uncertain distribution; consider disabling TKEY processing if not actively used via configuration directives; monitor named process crashes and configure automatic restart mechanisms to minimize downtime. Additionally, isolate DNS infrastructure behind firewalls to limit exposure to potential attackers who may hold TSIG keys.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-3039 HIGH
7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
CVE-2026-5946 HIGH
7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
CVE-2026-5947 MEDIUM
5.9 May 20

Denial of service in ISC BIND 9 resolvers can be triggered when a SIG(0)-signed DNS message is dropped under recursive-c
CVE-2026-3591 MEDIUM
5.4 Mar 25

A use-after-return vulnerability in ISC BIND 9's SIG(0) DNS query handler allows an attacker with low-level authenticati

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6
CVE-2023-37020 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
bind9
Release Status Version
trusty not-affected -
xenial not-affected -
bionic not-affected -
focal not-affected -
jammy not-affected 1:9.18.39-0ubuntu0.22.04.2
noble not-affected 1:9.18.39-0ubuntu0.24.04.2
upstream released 9.20.21,9.21.20
questing released 1:9.20.11-1ubuntu2.2
isc-dhcp
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic needs-triage -
focal not-affected code not present
jammy not-affected code not present
noble needs-triage -
questing needs-triage -
upstream needs-triage -
bind9-libs
Release Status Version
focal needs-triage -
jammy needs-triage -
noble DNE -
questing DNE -
upstream needs-triage -
USN-8124-1

Debian

bind9
Release Status Fixed Version Urgency
bullseye vulnerable 1:9.16.50-1~deb11u2 -
bullseye (security) vulnerable 1:9.16.50-1~deb11u4 -
bookworm vulnerable 1:9.18.41-1~deb12u1 -
bookworm (security) vulnerable 1:9.18.44-1~deb12u1 -
trixie (security), trixie vulnerable 1:9.20.18-1~deb13u1 -
forky vulnerable 1:9.20.20-1 -
sid vulnerable 1:9.20.21-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

CVE-2026-3119 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy