CVE-2026-19033

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description In a secondary zone where transfers are restricted by TSIG (Transaction Signature), the named process may begin serving data from a zone transfer before the final message containing the TSIG signature is received. This allows an attacker without a valid TSIG signature to send unauthorized zone contents to a secondary server. Because named does not rollback to the pre-transfer state when no signature arrives, the unauthorized data remains. This issue is exploitable during a multi-message TCP IXFR (Incremental Zone Transfer), as defined by RFC 8945.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.