CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, named does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Secondary BIND 9 zones that restrict transfers with TSIG are exposed if they run an affected version and can receive a multi-message TCP IXFR. Primary-only deployments and transfers that do not use this IXFR pattern are not described as affected.
What does an attacker need to exploit it?
An attacker must be able to send a multi-message TCP IXFR to the secondary server. They do not need to possess a valid TSIG signature, because the server may apply and serve transfer data before the final TSIG-bearing message is received.
What is the impact if exploitation succeeds?
The secondary server may serve unauthorized zone contents supplied during the transfer. If the expected TSIG signature never arrives, named does not roll the zone back to its pre-transfer state.
What versions require remediation?
Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. The provided references include BIND 9.20.29 and 9.21.26 releases.