CVE-2026-19941

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.29
https://downloads.isc.org/isc/bind9/9.21.26
https://kb.isc.org/docs/cve-2026-19941

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un registro NSEC no aplicable puede ser aceptado por un resolvedor “named” como prueba de que no existe un comodín, lo que podría permitir a un atacante en el mismo nivel o en un nivel ascendente del nombre de zona ocultar la existencia del registro comodín de la víctima. Este problema afecta a BIND?9 versiones 9.11.0 hasta la versión 9.18.50 incluida, 9.20.0 hasta la versión 9.20.27 incluida, 9.21.0 hasta la versión 9.21.25 incluida, 9.11.3?S1 hasta la versión 9.18.50?S1 incluida y 9.20.9?S1 hasta la versión 9.20.27?S1 incluida.

16 Sep 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 14:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-19941

Mitre link : CVE-2026-19941

CVE.ORG link : CVE-2026-19941

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-19941", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19941", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:44:04.658605Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.27"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.25"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.27-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T14:17:05.160", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.29", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-19941", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}, {"lang": "es", "value": "Un registro NSEC no aplicable puede ser aceptado por un resolvedor \u201cnamed\u201d como prueba de que no existe un comod\u00edn, lo que podr\u00eda permitir a un atacante en el mismo nivel o en un nivel ascendente del nombre de zona ocultar la existencia del registro comod\u00edn de la v\u00edctima. Este problema afecta a BIND?9 versiones 9.11.0 hasta la versi\u00f3n 9.18.50 incluida, 9.20.0 hasta la versi\u00f3n 9.20.27 incluida, 9.21.0 hasta la versi\u00f3n 9.21.25 incluida, 9.11.3?S1 hasta la versi\u00f3n 9.18.50?S1 incluida y 9.20.9?S1 hasta la versi\u00f3n 9.20.27?S1 incluida."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-officer@isc.org"}