CVE-2026-75029

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.29
https://downloads.isc.org/isc/bind9/9.21.26
https://kb.isc.org/docs/cve-2026-75029

Configurations

No configuration.

History

26 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En una respuesta de consulta, un atacante puede enviar “named” múltiples copias de un registro que solo debería existir una vez (como un registro SOA). Si el RDATA es idéntico en todas las copias, el registro se agrega al conjunto RDATA en memoria, lo que puede provocar un aumento del uso de memoria de la caché negativa y posiblemente conducir a otros vectores de ataque de memoria. Este problema afecta a BIND?9 versiones 9.11.0 hasta 9.18.50 incluidas, 9.20.0 hasta 9.20.27 incluidas, 9.21.0 hasta 9.21.25 incluidas, 9.11.3?S1 hasta 9.18.50?S1 incluidas, y 9.20.9?S1 hasta 9.20.27?S1 incluidas.

16 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 15:17

Updated : 2026-10-26 23:10

NVD link : CVE-2026-75029

Mitre link : CVE-2026-75029

CVE.ORG link : CVE-2026-75029

JSON object : View

Products Affected

No product.

CWE

CWE-405

Asymmetric Resource Consumption (Amplification)

{"id": "CVE-2026-75029", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75029", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:40:03.771347Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.27"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.25"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.27-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T15:17:43.577", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.29", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-75029", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}, {"lang": "es", "value": "En una respuesta de consulta, un atacante puede enviar \u201cnamed\u201d m\u00faltiples copias de un registro que solo deber\u00eda existir una vez (como un registro SOA). Si el RDATA es id\u00e9ntico en todas las copias, el registro se agrega al conjunto RDATA en memoria, lo que puede provocar un aumento del uso de memoria de la cach\u00e9 negativa y posiblemente conducir a otros vectores de ataque de memoria. Este problema afecta a BIND?9 versiones 9.11.0 hasta 9.18.50 incluidas, 9.20.0 hasta 9.20.27 incluidas, 9.21.0 hasta 9.21.25 incluidas, 9.11.3?S1 hasta 9.18.50?S1 incluidas, y 9.20.9?S1 hasta 9.20.27?S1 incluidas."}], "lastModified": "2026-10-26T23:10:00.183", "sourceIdentifier": "security-officer@isc.org"}