Description
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Scores
CVSS v3
5.4
EPSS
0.0002
EPSS Percentile
6.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-305
CWE-562
Status
published
Products (5)
ISC/BIND 9
9.18.0 - 9.18.46
ISC/BIND 9
9.18.11-S1 - 9.18.46-S1
ISC/BIND 9
9.20.0 - 9.20.20
ISC/BIND 9
9.20.9-S1 - 9.20.20-S1
ISC/BIND 9
9.21.0 - 9.21.19
Published
Mar 25, 2026
Tracked Since
Mar 25, 2026