CVE-2026-77119

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.29
https://downloads.isc.org/isc/bind9/9.21.26
https://kb.isc.org/docs/cve-2026-77119

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un NSEC3 firmado válidamente proveniente de una zona hermana no relacionada puede ser aceptado como prueba de inseguridad, degradando una delegación segura y permitiendo que una respuesta falsificada sin firma pase. \nEste problema afecta a BIND?9 desde la versión 9.11.0 hasta la versión 9.18.50 incluida, desde la versión 9.20.0 hasta la versión 9.20.27 incluida, desde la versión 9.21.0 hasta la versión 9.21.25 incluida, desde la versión 9.11.3?S1 hasta la versión 9.18.50?S1 incluida, y desde la versión 9.20.9?S1 hasta la versión 9.20.27?S1 incluida.

16 Sep 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 15:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-77119

Mitre link : CVE-2026-77119

CVE.ORG link : CVE-2026-77119

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2026-77119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77119", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:39:32.807057Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.27"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.25"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.27-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T15:17:46.427", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.29", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.26", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-77119", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}, {"lang": "es", "value": "Un NSEC3 firmado v\u00e1lidamente proveniente de una zona hermana no relacionada puede ser aceptado como prueba de inseguridad, degradando una delegaci\u00f3n segura y permitiendo que una respuesta falsificada sin firma pase. \\nEste problema afecta a BIND?9 desde la versi\u00f3n 9.11.0 hasta la versi\u00f3n 9.18.50 incluida, desde la versi\u00f3n 9.20.0 hasta la versi\u00f3n 9.20.27 incluida, desde la versi\u00f3n 9.21.0 hasta la versi\u00f3n 9.21.25 incluida, desde la versi\u00f3n 9.11.3?S1 hasta la versi\u00f3n 9.18.50?S1 incluida, y desde la versi\u00f3n 9.20.9?S1 hasta la versi\u00f3n 9.20.27?S1 incluida."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-officer@isc.org"}