EUVD-2026-80767
GHSA-wx7p-v693-68jh
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Attacker must control the zone-transfer source to inject the malformed zone (PR:H, AC:H); scope changes as out-of-zone names are affected (S:C), integrity-only impact via cache poisoning (I:H, C:N, A:N).
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
A malformed zone loaded into ISC BIND 9 authoritative servers can contain an NS or DNAME node above the zone origin, which named misinterprets as a zone cut, so queries for names inside the configured zone lose authoritative status and return out-of-zone delegations. Exploitation requires high privileges (PR:H) because the attacker must control the zone data delivered to the server, for example by controlling a primary from which the target secondary performs zone transfers; this is not a remotely unauthenticated attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to get a malformed zone (containing an NS or DNAME node above its origin) loaded into the BIND authoritative server - the description names zone transfer as the delivery mechanism, so the attacker must control or compromise a primary the target secondaries from, or otherwise control the zone data (hence PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity flaw, best characterized as a DNS cache-poisoning/spoofing bug (CWE-349, Acceptance of Extraneous Untrusted Data With Trusted Data) rather than the 'Information Disclosure' its tag implies - the CVSS vector is explicit that C:N and A:N, with I:H being the sole impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released fixed versions: BIND 9.20.29 or BIND 9.21.26 (or later), available from https://downloads.isc.org/isc/bind9/9.20.29 and https://downloads.isc.org/isc/bind9/9.21.26, and consult the advisory at https://kb.isc.org/docs/cve-2026-78301 for branch-specific guidance, since 9.18.50 and earlier branches remain affected. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Share
External POC / Exploit Code
Leaving vuln.today