Skip to main content

Bind 9 EUVDEUVD-2026-15413

| CVE-2026-3591 MEDIUM
Return of Stack Variable Address (CWE-562)
2026-03-25 isc GHSA-5fv2-2p94-9gh7
Authentication Bypass Bind 9
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative
Red Hat
5.4 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 25, 2026 - 14:00 euvd
EUVD-2026-15413
Analysis Generated
Mar 25, 2026 - 14:00 vuln.today
Patch released
Mar 25, 2026 - 14:00 nvd
Patch available
CVE Published
Mar 25, 2026 - 13:34 nvd
MEDIUM 5.4

DescriptionCVE.org

A use-after-return vulnerability exists in the named server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

AnalysisAI

A use-after-return vulnerability in ISC BIND 9's SIG(0) DNS query handler allows an attacker with low-level authentication privileges to manipulate ACL matching logic, potentially bypassing default-allow access controls and gaining unauthorized access to DNS services. The vulnerability affects BIND 9 versions 9.20.0-9.20.20, 9.21.0-9.21.19, and their security branches (9.20.9-S1-9.20.20-S1), while older stable releases (9.18.x) are unaffected. Vendor patches are available, and the moderate CVSS 5.4 score reflects limited technical impact when ACLs are properly configured with fail-secure defaults.

Technical ContextAI

BIND 9 (ISC BIND, CPE: cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:*) is the world's most widely deployed DNS server software. This vulnerability is rooted in CWE-562 (use-after-return), a memory safety defect where a function returns a reference to a stack-allocated variable that becomes invalid after the function returns; subsequent dereferencing of this stale pointer corrupts memory or causes undefined behavior. The specific trigger involves SIG(0) cryptographic signatures, which are DNSSEC signing mechanisms used for transactional authentication in DNS UPDATE requests. The bug causes ACL evaluation logic to read from invalid memory when processing SIG(0)-signed queries, leading to unpredictable ACL match/mismatch results. The vulnerability only manifests in BIND 9.20.x and 9.21.x branches; the stable 9.18.x series was unaffected, suggesting the defect was introduced in recent development cycles.

RemediationAI

Upgrade BIND 9 immediately to patched versions: BIND 9.20.21 or later (available at https://downloads.isc.org/isc/bind9/9.20.21) or BIND 9.21.20 or later (available at https://downloads.isc.org/isc/bind9/9.21.20). Organizations unable to patch immediately should implement defense-in-depth: enforce default-deny ACLs (explicitly allow only trusted DNS UPDATE clients and query sources), disable SIG(0) authentication if not in use via BIND configuration, restrict DNS protocol access at the network perimeter using firewall rules to limit UPDATE traffic to authorized administrative networks, and audit ACL configurations to identify any default-allow rules that may be affected. Monitor BIND logs for SIG(0)-signed queries from unexpected sources, which may indicate exploitation attempts.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-3039 HIGH
7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
CVE-2026-5946 HIGH
7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
CVE-2026-3119 MEDIUM
6.5 Mar 25

BIND 9 DNS server crashes when processing specially crafted TSIG-authenticated queries containing TKEY records, affectin
CVE-2026-5947 MEDIUM
5.9 May 20

Denial of service in ISC BIND 9 resolvers can be triggered when a SIG(0)-signed DNS message is dropped under recursive-c

Same weakness CWE-562 – Return of Stack Variable Address

View all
CVE-2022-41837 CRITICAL POC
9.8
CVE-2021-21798 HIGH POC
7.8
CVE-2024-33045 HIGH
7.8
CVE-2024-4418 MEDIUM
6.2
CVE-2026-34553 MEDIUM
4.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
bind9
Release Status Version
trusty not-affected -
xenial not-affected -
bionic not-affected -
focal not-affected -
jammy not-affected 1:9.18.39-0ubuntu0.22.04.2
noble not-affected 1:9.18.39-0ubuntu0.24.04.2
upstream released 9.20.21,9.21.20
questing released 1:9.20.11-1ubuntu2.2
isc-dhcp
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic needs-triage -
focal not-affected code not present
jammy not-affected code not present
noble needs-triage -
questing needs-triage -
upstream needs-triage -
bind9-libs
Release Status Version
focal needs-triage -
jammy needs-triage -
noble DNE -
questing DNE -
upstream needs-triage -
USN-8124-1

Debian

bind9
Release Status Fixed Version Urgency
bullseye vulnerable 1:9.16.50-1~deb11u2 -
bullseye (security) vulnerable 1:9.16.50-1~deb11u4 -
bookworm vulnerable 1:9.18.41-1~deb12u1 -
bookworm (security) vulnerable 1:9.18.44-1~deb12u1 -
trixie (security), trixie vulnerable 1:9.20.18-1~deb13u1 -
forky vulnerable 1:9.20.20-1 -
sid vulnerable 1:9.20.21-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

Share

EUVD-2026-15413 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy