EUVD-2026-80781
GHSA-r7m2-338w-h24g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Network-reachable with no TSIG key (PR:N) but AC:H for the primary-position and race preconditions; integrity-primary injection (I:H), minor A:L from serving bad data, no confidentiality impact.
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, named does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
BIND 9 secondary (slave) servers that restrict zone transfers with TSIG can be tricked into serving attacker-supplied zone contents: an attacker able to occupy or spoof the position of the configured primary can deliver a multi-message TCP IXFR whose final TSIG-signed message never arrives, and named commits and serves the records already received without rolling back to the pre-transfer state. Affected releases are BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25, along with the -S1 builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; no valid TSIG key is required (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, 6.5), but exploitation is conditional on the attacker's network position and the multi-message IXFR condition, so this is an integrity-only, high-complexity issue rather than a broadly reachable critical flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a BIND 9 secondary (slave) zone whose transfers are restricted by TSIG, and the transfer must be a multi-message TCP IXFR as defined by RFC 8945 (single-message or AXFR paths are not stated to be affected). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity vulnerability, not a headline-grabbing critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: ISC has published fixed downloads for the 9.20 and 9.21 branches at https://downloads.isc.org/isc/bind9/9.20.29 and https://downloads.isc.org/isc/bind9/9.21.26, with the advisory at https://kb.isc.org/docs/cve-2026-19033; upgrade secondaries (and primaries, for consistency) to the patched release for your branch, and plan migration off the legacy 9.11-9.18 and -S1 lines where a fixed build is the only durable fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today