CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts
A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which BIND release ranges are affected?
Affected releases are BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
What level of attacker access and exploit conditions are reflected in the severity assessment?
The CVSS vector rates the issue as network-accessible with high attack complexity and requiring high privileges. No user interaction is required.
What security impact is indicated by the CVSS assessment?
The assessment indicates high integrity impact, with no confidentiality or availability impact. It also indicates scope can change.