CVE-2026-3119

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3119", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-02-24T12:29:14.561Z", "datePublished": "2026-03-25T13:31:54.806Z", "dateUpdated": "2026-03-25T14:13:54.588Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-03-25T13:31:54.806Z"}, "title": "Authenticated query containing a TKEY record may cause named to terminate unexpectedly", "datePublic": "2026-03-25T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.20.0", "lessThanOrEqual": "9.20.20", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.19", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.20-S1", "status": "affected", "versionType": "custom"}, {"version": "9.18.0", "lessThanOrEqual": "9.18.46", "status": "unaffected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.20-S1"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.0", "versionEndIncluding": "9.18.46"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.11-S1", "versionEndIncluding": "9.18.46-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable Assertion"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}], "impacts": [{"descriptions": [{"lang": "en", "value": "If this situation is encountered, `named` will terminate unexpectedly."}]}], "workarounds": [{"lang": "en", "value": "Remove any TSIG keys that might be used by an attacker."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-3119", "name": "CVE-2026-3119", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.21", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.20", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:13:41.579382Z", "id": "CVE-2026-3119", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:13:54.588Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3119", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-02-24T12:29:14.561Z", "datePublished": "2026-03-25T13:31:54.806Z", "dateUpdated": "2026-03-25T14:13:54.588Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-03-25T13:31:54.806Z"}, "title": "Authenticated query containing a TKEY record may cause named to terminate unexpectedly", "datePublic": "2026-03-25T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.20.0", "lessThanOrEqual": "9.20.20", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.19", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.20-S1", "status": "affected", "versionType": "custom"}, {"version": "9.18.0", "lessThanOrEqual": "9.18.46", "status": "unaffected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.20-S1"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.0", "versionEndIncluding": "9.18.46"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.11-S1", "versionEndIncluding": "9.18.46-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable Assertion"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}], "impacts": [{"descriptions": [{"lang": "en", "value": "If this situation is encountered, `named` will terminate unexpectedly."}]}], "workarounds": [{"lang": "en", "value": "Remove any TSIG keys that might be used by an attacker."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-3119", "name": "CVE-2026-3119", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.21", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.20", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3119", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:13:41.579382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:13:48.560Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BIND 9", "vendor": "ISC", "versions": [{"lessThanOrEqual": "9.20.20", "status": "affected", "version": "9.20.0", "versionType": "custom"}, {"lessThanOrEqual": "9.21.19", "status": "affected", "version": "9.21.0", "versionType": "custom"}, {"lessThanOrEqual": "9.20.20-S1", "status": "affected", "version": "9.20.9-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.18.46", "status": "unaffected", "version": "9.18.0", "versionType": "custom"}, {"lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "version": "9.18.11-S1", "versionType": "custom"}]}], "source": "security-officer@isc.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*", "matchCriteriaId": "2C0EF5D0-68A6-4E00-985B-523D9B243E49", "versionEndExcluding": "9.20.21", "versionStartIncluding": "9.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*", "matchCriteriaId": "B1DD0950-5CBD-49B2-8007-5E96B3C4FB1B", "versionEndExcluding": "9.21.20", "versionStartIncluding": "9.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}, {"lang": "es", "value": "Bajo ciertas condiciones, 'named' puede colapsar al procesar una consulta correctamente firmada que contiene un registro TKEY. El c\u00f3digo afectado solo se puede acceder si una solicitud entrante tiene una firma de transacci\u00f3n (TSIG) v\u00e1lida de una clave declarada en la configuraci\u00f3n de 'named'.\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.20, 9.21.0 a 9.21.19, y 9.20.9-S1 a 9.20.20-S1.\nLas versiones de BIND 9 9.18.0 a 9.18.46 y 9.18.11-S1 a 9.18.46-S1 NO est\u00e1n afectadas."}], "id": "CVE-2026-3119", "lastModified": "2026-06-17T10:43:04.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-officer@isc.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3119", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:13:41.579382Z", "version": "2.0.3"}}]}, "published": "2026-03-25T14:16:37.097", "references": [{"source": "security-officer@isc.org", "tags": ["Patch"], "url": "https://downloads.isc.org/isc/bind9/9.20.21"}, {"source": "security-officer@isc.org", "tags": ["Patch"], "url": "https://downloads.isc.org/isc/bind9/9.21.20"}, {"source": "security-officer@isc.org", "tags": ["Vendor Advisory"], "url": "https://kb.isc.org/docs/cve-2026-3119"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "security-officer@isc.org", "type": "Secondary"}]}

{"bugzilla": {"description": "bind: BIND: Denial of Service via authenticated TKEY queries", "id": "2451308", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451308"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-237", "details": ["A flaw was found in BIND, specifically within the `named` daemon. An authenticated remote attacker, possessing a valid Transaction Signature (TSIG) key configured on the server, could send a specially crafted query containing a TKEY record. This action may cause the `named` daemon to crash, leading to a Denial of Service (DoS) for the affected DNS service."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict access to the `named` service to only trusted networks and clients. If Transaction Signature (TSIG) keys are not actively used or required, consider disabling them in the BIND configuration. If TSIG keys are necessary, ensure they are securely managed and only distributed to authorized clients. After making configuration changes, a restart of the `named` service may be required to apply the changes, which could temporarily impact DNS resolution."}, "name": "CVE-2026-3119", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind9.16", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind9.18", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-03-25T13:31:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3119\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3119\nhttps://downloads.isc.org/isc/bind9/9.20.21\nhttps://downloads.isc.org/isc/bind9/9.21.20\nhttps://kb.isc.org/docs/cve-2026-3119"], "statement": "Moderate impact. A flaw in BIND 9's `named` component can lead to a Denial of Service if an attacker with a valid Transaction Signature (TSIG) key sends a specially crafted query. Red Hat Enterprise Linux 8 and 9 are affected by this vulnerability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.0,9.20.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.21.0,9.21.19]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.9-S1,9.20.20-S1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[9.18.0,9.18.46]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[9.18.11-S1,9.18.46-S1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BIND 9", "source": "cna", "vendor": "ISC"}, "product": "bind", "vendor": "isc"}], "analysis": {"en": {"generated_at": "2026-03-26T04:45:06.199797+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest BIND 9 release (9.20.21, 9.21.20, or 9.20.21-S1) that contains the patch.", "Remove any TSIG keys that could be used by an attacker to sign queries.", "Verify that only necessary TSIG keys are configured in named.conf.", "Monitor named process for unexpected restarts as a potential indicator of an attack."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "ISC:BIND 9 releases 9.20.0\u20139.20.20, 9.21.0\u20139.21.19, and 9.20.9-S1\u20139.20.20-S1 are affected. Earlier 9.18.x releases are not impacted.", "description_and_impact": "BIND 9's named daemon may crash when processing a correctly signed query that contains a TKEY record. The flaw is triggered only when the query includes a valid TSIG signature from a key defined in the server\u2019s configuration. The crash results in a sudden termination of the named process, leading to a denial of service for DNS resolution on the affected system.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity. Because an attacker needs to send a DNS query signed with a TSIG key that the server trusts, the likelihood of exploitation depends on how many unnecessary TSIG keys are present. Successful exploitation would briefly disrupt DNS services on the affected host. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available."}}}}, "created": "2026-03-25T21:31:10.449801+00:00", "updated": "2026-03-26T12:13:26.240299+00:00", "vendors": ["isc", "isc$PRODUCT$bind"]}