isc

Latest CVEs · RSS

• CVE-2026-77119 2026-09-16 · CVSS 5.9
  A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answ
• CVE-2026-75029 2026-09-16 · CVSS 5.3
  In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on a
• CVE-2026-19668 2026-09-16 · CVSS 5.3
  A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default l
• CVE-2026-19033 2026-09-16 · CVSS 6.5
  For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG s
• CVE-2026-80274 2026-09-16 · CVSS 7.5
  If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proo
• CVE-2026-76163 2026-09-16 · CVSS 7.5
  If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion
• CVE-2026-19666 2026-09-16 · CVSS 7.5
  On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process wi
• CVE-2026-81563 2026-09-16 · CVSS 7.5
  A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resou
• CVE-2026-78301 2026-09-16 · CVSS 5.8
  A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND autho
• CVE-2026-77692 2026-09-16 · CVSS 7.5
  An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transpor
• CVE-2026-19941 2026-09-16 · CVSS 5.9
  An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream lev
• CVE-2026-19662 2026-09-16 · CVSS 5.9
  An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone
• CVE-2026-19667 2026-09-16 · CVSS 7.5
  If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache ent
• CVE-2026-81736 2026-09-16 · CVSS 7.5
  If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CP
• CVE-2026-13321 2026-07-22 · CVSS 8.6
  The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.
• CVE-2026-13204 2026-07-22 · CVSS 7.5
  If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exi
• CVE-2026-12617 2026-07-22 · CVSS 7.5
  The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, i
• CVE-2026-11721 2026-07-22 · CVSS 7.5
  It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Thi
• CVE-2026-11622 2026-07-22 · CVSS 7.5
  A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be
• CVE-2026-11605 2026-07-22 · CVSS 7.5
  The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not s
• CVE-2026-11331 2026-07-22 · CVSS 7.5
  An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condit
• CVE-2026-10822 2026-07-22 · CVSS 6.5
  If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first n
• CVE-2026-10723 2026-07-22 · CVSS 6.8
  BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9
• CVE-2026-5950 2026-05-20 · CVSS 5.3
  An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cau
• CVE-2026-5947 2026-05-20 · CVSS 7.5
  Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it be