EUVD-2026-80787
GHSA-r3pf-h3x3-rv3w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated (AV:N/PR:N) but attacker must supply a valid sibling-zone NSEC3 and win the response path (AC:H); integrity-only DNSSEC downgrade means C:N/A:N, I:H.
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
DNSSEC validation downgrade in ISC BIND 9 lets a remote, unauthenticated attacker who can inject or spoof responses on the resolution path present a validly signed NSEC3 record taken from an unrelated sibling zone as an insecurity proof, so a securely delegated name is treated as insecure and a forged unsigned answer is accepted. Only resolvers actively performing DNSSEC validation are exposed, and the affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target BIND 9 resolver to be performing DNSSEC validation and to query a name under a securely-delegated zone that the attacker can answer for. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine DNSSEC integrity vulnerability, not an inflated high-CVSS finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed release: ISC has published BIND 9.20.29 (https://downloads.isc.org/isc/bind9/9.20.29) and BIND 9.21.26 (https://downloads.isc.org/isc/bind9/9.21.26), which resolve the cross-zone NSEC3 acceptance; the vendor advisory at https://kb.isc.org/docs/cve-2026-77119 should be used to confirm which fixed build matches your current maintenance branch, since the 9.18 and subscription (S1) branches are not covered by the two release URLs supplied here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same weakness CWE-346 – Origin Validation Error
View allShare
External POC / Exploit Code
Leaving vuln.today