{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78301", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-08-24T07:52:08.223Z", "datePublished": "2026-09-16T13:58:11.312Z", "dateUpdated": "2026-09-17T18:43:12.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-09-16T13:58:11.312Z"}, "title": "Out-of-zone database nodes can become authoritative zone cuts", "datePublic": "2026-09-16T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.11.0", "lessThanOrEqual": "9.18.50", "status": "affected", "versionType": "custom"}, {"version": "9.20.0", "lessThanOrEqual": "9.20.27", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.25", "status": "affected", "versionType": "custom"}, {"version": "9.11.3-S1", "lessThanOrEqual": "9.18.50-S1", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.27-S1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.0", "versionEndIncluding": "9.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.27"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.25"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.3-S1", "versionEndIncluding": "9.18.50-S1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.27-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-349", "description": "CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data"}]}], "descriptions": [{"lang": "en", "value": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "In a successful attack on an authoritative server that is also a resolver, cache poisoning may occur with attacker supplied records. A purely authoritative server may return bogus attacker-supplied referrals to queries but without the AA flag."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.29, 9.21.26, or 9.20.29-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Henrique Pereira for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-78301", "name": "CVE-2026-78301", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.29", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T18:43:00.321566Z", "id": "CVE-2026-78301", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:43:12.526Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78301", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-08-24T07:52:08.223Z", "datePublished": "2026-09-16T13:58:11.312Z", "dateUpdated": "2026-09-17T18:43:12.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-09-16T13:58:11.312Z"}, "title": "Out-of-zone database nodes can become authoritative zone cuts", "datePublic": "2026-09-16T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.11.0", "lessThanOrEqual": "9.18.50", "status": "affected", "versionType": "custom"}, {"version": "9.20.0", "lessThanOrEqual": "9.20.27", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.25", "status": "affected", "versionType": "custom"}, {"version": "9.11.3-S1", "lessThanOrEqual": "9.18.50-S1", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.27-S1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.0", "versionEndIncluding": "9.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.27"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.25"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.3-S1", "versionEndIncluding": "9.18.50-S1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.27-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-349", "description": "CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data"}]}], "descriptions": [{"lang": "en", "value": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "In a successful attack on an authoritative server that is also a resolver, cache poisoning may occur with attacker supplied records. A purely authoritative server may return bogus attacker-supplied referrals to queries but without the AA flag."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.29, 9.21.26, or 9.20.29-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Henrique Pereira for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-78301", "name": "CVE-2026-78301", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.29", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78301", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:43:00.321566Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:43:07.666Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BIND 9", "vendor": "ISC", "versions": [{"lessThanOrEqual": "9.18.50", "status": "affected", "version": "9.11.0", "versionType": "custom"}, {"lessThanOrEqual": "9.20.27", "status": "affected", "version": "9.20.0", "versionType": "custom"}, {"lessThanOrEqual": "9.21.25", "status": "affected", "version": "9.21.0", "versionType": "custom"}, {"lessThanOrEqual": "9.18.50-S1", "status": "affected", "version": "9.11.3-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.20.27-S1", "status": "affected", "version": "9.20.9-S1", "versionType": "custom"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}], "id": "CVE-2026-78301", "lastModified": "2026-09-17T19:16:59.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78301", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T18:43:00.321566Z", "version": "2.0.3"}}]}, "published": "2026-09-16T14:17:10.400", "references": [{"source": "[email protected]", "url": "https://downloads.isc.org/isc/bind9/9.20.29"}, {"source": "[email protected]", "url": "https://downloads.isc.org/isc/bind9/9.21.26"}, {"source": "[email protected]", "url": "https://kb.isc.org/docs/cve-2026-78301"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-349"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "bind: BIND: DNS cache poisoning via malformed zone insertion", "id": "2535463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535463"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-168", "details": ["A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Red Hat recommends separating authoritative and recursive DNS functions onto different BIND instances or servers. This prevents a compromised authoritative zone from affecting recursive queries. Additionally, restrict zone transfer sources to trusted hosts only by configuring `allow-transfer` directives within your `named.conf` zone definitions. After modifying `named.conf`, the BIND service must be reloaded for changes to take effect, which may temporarily interrupt DNS resolution."}, "name": "CVE-2026-78301", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind9.16", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind9.18", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-16T13:58:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-78301\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-78301\nhttps://downloads.isc.org/isc/bind9/9.20.29\nhttps://downloads.isc.org/isc/bind9/9.21.26\nhttps://kb.isc.org/docs/cve-2026-78301"], "statement": "Moderate impact. BIND servers configured for both authoritative and recursive functions are vulnerable to DNS cache poisoning. An attacker who can insert a malformed zone, for example via zone transfer, can cause the server to cache attacker-supplied data for names outside the configured zone.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.0,9.18.50]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.0,9.20.27]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.21.0,9.21.25]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.3-S1,9.18.50-S1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.9-S1,9.20.27-S1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BIND 9", "source": "cna", "vendor": "ISC"}, "product": "bind", "vendor": "isc"}], "created": "2026-09-17T02:30:08.256645+00:00", "updated": "2026-09-17T02:30:08.256680+00:00", "vendors": ["isc", "isc$PRODUCT$bind"]}