CVE-2026-78301

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description A malformed zone containing an NS or DNAME node above its origin is treated as a zone cut by named. An attacker can insert such a zone into an authoritative server, causing queries for names within the configured zone to lose authoritative status and return an out-of-zone delegation. If the server also provides recursion, BIND may follow this locally sourced cut and cache attacker-supplied data, which impacts names outside the configured zone. This state continues as long as the malformed zone exists in the zone database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.