EUVD-2026-15413
GHSA-5fv2-2p94-9gh7
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Description
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Analysis
A use-after-return vulnerability in ISC BIND 9's SIG(0) DNS query handler allows an attacker with low-level authentication privileges to manipulate ACL matching logic, potentially bypassing default-allow access controls and gaining unauthorized access to DNS services. The vulnerability affects BIND 9 versions 9.20.0-9.20.20, 9.21.0-9.21.19, and their security branches (9.20.9-S1-9.20.20-S1), while older stable releases (9.18.x) are unaffected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | not-affected | - |
| xenial | not-affected | - |
| bionic | not-affected | - |
| focal | not-affected | - |
| jammy | not-affected | 1:9.18.39-0ubuntu0.22.04.2 |
| noble | not-affected | 1:9.18.39-0ubuntu0.24.04.2 |
| upstream | released | 9.20.21,9.21.20 |
| questing | released | 1:9.20.11-1ubuntu2.2 |
| Release | Status | Version |
|---|---|---|
| trusty | not-affected | code not present |
| xenial | not-affected | code not present |
| bionic | needs-triage | - |
| focal | not-affected | code not present |
| jammy | not-affected | code not present |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | DNE | - |
| questing | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1:9.16.50-1~deb11u2 | - |
| bullseye (security) | vulnerable | 1:9.16.50-1~deb11u4 | - |
| bookworm | vulnerable | 1:9.18.41-1~deb12u1 | - |
| bookworm (security) | vulnerable | 1:9.18.44-1~deb12u1 | - |
| trixie (security), trixie | vulnerable | 1:9.20.18-1~deb13u1 | - |
| forky | vulnerable | 1:9.20.20-1 | - |
| sid | vulnerable | 1:9.20.21-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today