CVE-2026-3119

EUVD-2026-15411

25.03.2026, 14:16

Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
isc	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

bind9

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

bind9

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
questing	Fixed 1:9.20.11-1ubuntu2.2 released
trusty	not-affected
xenial	not-affected

isc-dhcp

bionic	needs-triage
focal	not-affected
jammy	not-affected
noble	needs-triage
questing	needs-triage
trusty	not-affected
xenial	not-affected

bind9-libs

focal	needs-triage
jammy	needs-triage
noble	dne
questing	dne

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

https://downloads.isc.org/isc/bind9/9.20.21

https://downloads.isc.org/isc/bind9/9.21.20

https://kb.isc.org/docs/cve-2026-3119