CVE-2026-13204

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.26
https://downloads.isc.org/isc/bind9/9.21.24
https://kb.isc.org/docs/cve-2026-13204

Configurations

No configuration.

History

24 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Si un dominio demostrablemente inseguro está cubierto por un registro NSEC y NSEC3 en el padre, y existe un RRSIG para solo uno de estos tipos, entonces BIND puede cerrarse inesperadamente con una aserción mientras valida esta prueba. Este problema afecta a las versiones de BIND 9 9.11.0 hasta 9.18.50, 9.20.0 hasta 9.20.24, 9.21.0 hasta 9.21.23, 9.11.3-S1 hasta 9.18.50-S1, y 9.20.9-S1 hasta 9.20.24-S1.

Information

Published : 2026-07-22 15:16

Updated : 2026-10-24 18:10

NVD link : CVE-2026-13204

Mitre link : CVE-2026-13204

CVE.ORG link : CVE-2026-13204

JSON object : View

Products Affected

No product.

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-13204", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13204", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:51:59.528740Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.24"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.23"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.24-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T15:16:52.080", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.26", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.24", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-13204", "source": "security-officer@isc.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."}, {"lang": "es", "value": "Si un dominio demostrablemente inseguro est\u00e1 cubierto por un registro NSEC y NSEC3 en el padre, y existe un RRSIG para solo uno de estos tipos, entonces BIND puede cerrarse inesperadamente con una aserci\u00f3n mientras valida esta prueba.\nEste problema afecta a las versiones de BIND 9 9.11.0 hasta 9.18.50, 9.20.0 hasta 9.20.24, 9.21.0 hasta 9.21.23, 9.11.3-S1 hasta 9.18.50-S1, y 9.20.9-S1 hasta 9.20.24-S1."}], "lastModified": "2026-10-24T18:10:00.163", "sourceIdentifier": "security-officer@isc.org"}