EUVD-2026-80745
GHSA-38fx-cm5x-27pg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated (AV:N/PR:N) but AC:H because it needs a privileged same/upstream zone position and crafted NSEC; impact is integrity-only (I:H, C:N/A:N).
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An inapplicable NSEC record may be accepted by a named resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
DNSSEC-validating BIND 9 resolvers can be induced to accept an inapplicable NSEC record as proof that no wildcard exists at a given name, letting an attacker who controls a zone at the same or an upstream level of the victim's name mask the existence of the victim's wildcard record and thereby disrupt resolution of names it should answer. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 subscription branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a BIND 9 resolver performing DNSSEC validation; (2) the attacker holding a position at the same or an upstream level of the victim's zone name (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but specialized integrity vulnerability, not a high-severity emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed releases published by ISC: BIND 9.20.29 (https://downloads.isc.org/isc/bind9/9.20.29) or BIND 9.21.26 (https://downloads.isc.org/isc/bind9/9.21.26), and consult the vendor advisory at https://kb.isc.org/docs/cve-2026-19941 for the corresponding fixes on the 9.18.x and 9.11.3-S1 through 9.18.x-S1 subscription branches, which are affected but whose exact patched build identifiers are not enumerated in the reference data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Share
External POC / Exploit Code
Leaving vuln.today