CVE-2026-3591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3591", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-03-05T12:50:58.915Z", "datePublished": "2026-03-25T13:34:14.202Z", "dateUpdated": "2026-03-25T14:13:01.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-03-25T13:34:14.202Z"}, "title": "A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass", "datePublic": "2026-03-25T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.20.0", "lessThanOrEqual": "9.20.20", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.19", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.20-S1", "status": "affected", "versionType": "custom"}, {"version": "9.18.0", "lessThanOrEqual": "9.18.46", "status": "unaffected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.20-S1"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.0", "versionEndIncluding": "9.18.46"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.11-S1", "versionEndIncluding": "9.18.46-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-562", "description": "CWE-562 Return of Stack Variable Address"}, {"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness"}]}], "descriptions": [{"lang": "en", "value": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Mcsky23 for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-3591", "name": "CVE-2026-3591", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.21", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.20", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:12:43.295485Z", "id": "CVE-2026-3591", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:13:01.659Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3591", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-03-05T12:50:58.915Z", "datePublished": "2026-03-25T13:34:14.202Z", "dateUpdated": "2026-03-25T14:13:01.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-03-25T13:34:14.202Z"}, "title": "A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass", "datePublic": "2026-03-25T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.20.0", "lessThanOrEqual": "9.20.20", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.19", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.20-S1", "status": "affected", "versionType": "custom"}, {"version": "9.18.0", "lessThanOrEqual": "9.18.46", "status": "unaffected", "versionType": "custom"}, {"version": "9.18.11-S1", "lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.20-S1"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.0", "versionEndIncluding": "9.18.46"}, {"vulnerable": false, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.18.11-S1", "versionEndIncluding": "9.18.46-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-562", "description": "CWE-562 Return of Stack Variable Address"}, {"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness"}]}], "descriptions": [{"lang": "en", "value": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."}], "credits": [{"lang": "en", "value": "ISC would like to thank Mcsky23 for bringing this vulnerability to our attention."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-3591", "name": "CVE-2026-3591", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.21", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.20", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3591", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:12:43.295485Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:12:54.940Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BIND 9", "vendor": "ISC", "versions": [{"lessThanOrEqual": "9.20.20", "status": "affected", "version": "9.20.0", "versionType": "custom"}, {"lessThanOrEqual": "9.21.19", "status": "affected", "version": "9.21.0", "versionType": "custom"}, {"lessThanOrEqual": "9.20.20-S1", "status": "affected", "version": "9.20.9-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.18.46", "status": "unaffected", "version": "9.18.0", "versionType": "custom"}, {"lessThanOrEqual": "9.18.46-S1", "status": "unaffected", "version": "9.18.11-S1", "versionType": "custom"}]}], "source": "security-officer@isc.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*", "matchCriteriaId": "2C0EF5D0-68A6-4E00-985B-523D9B243E49", "versionEndExcluding": "9.20.21", "versionStartIncluding": "9.20.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*", "matchCriteriaId": "B1DD0950-5CBD-49B2-8007-5E96B3C4FB1B", "versionEndExcluding": "9.21.20", "versionStartIncluding": "9.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."}, {"lang": "es", "value": "Una vulnerabilidad de use-after-return existe en el servidor 'named' al manejar consultas DNS firmadas con SIG(0). Usando una solicitud DNS especialmente dise\u00f1ada, un atacante podr\u00eda ser capaz de hacer que una ACL haga una coincidencia incorrecta con una direcci\u00f3n IP. En una ACL de permiso predeterminado (negando solo direcciones IP espec\u00edficas), esto podr\u00eda llevar a acceso no autorizado. Las ACL de denegaci\u00f3n predeterminada deber\u00edan fallar de forma segura.\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.20, 9.21.0 a 9.21.19, y 9.20.9-S1 a 9.20.20-S1.\nLas versiones de BIND 9 9.18.0 a 9.18.46 y 9.18.11-S1 a 9.18.46-S1 NO est\u00e1n afectadas."}], "id": "CVE-2026-3591", "lastModified": "2026-06-17T10:43:50.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-officer@isc.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3591", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:12:43.295485Z", "version": "2.0.3"}}]}, "published": "2026-03-25T14:16:37.297", "references": [{"source": "security-officer@isc.org", "tags": ["Patch"], "url": "https://downloads.isc.org/isc/bind9/9.20.21"}, {"source": "security-officer@isc.org", "tags": ["Patch"], "url": "https://downloads.isc.org/isc/bind9/9.21.20"}, {"source": "security-officer@isc.org", "tags": ["Vendor Advisory"], "url": "https://kb.isc.org/docs/cve-2026-3591"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}, {"lang": "en", "value": "CWE-562"}], "source": "security-officer@isc.org", "type": "Secondary"}]}

{"bugzilla": {"description": "bind: BIND: Unauthorized access due to use-after-return vulnerability in DNS query handling", "id": "2451298", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451298"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in BIND, specifically in the named server's handling of DNS queries signed with SIG(0). A remote attacker could exploit this use-after-return vulnerability by sending a specially-crafted DNS request. This could cause an Access Control List (ACL) to improperly match an IP address, potentially leading to unauthorized access to resources."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the `named` service to trusted clients and networks. Configure firewall rules to limit inbound connections to the DNS service port (UDP/TCP 53). For example, using `firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_IP_RANGE>\" port port=\"53\" protocol=\"udp\" accept'` and `firewall-cmd --reload`. This action may impact DNS resolution for clients outside the specified trusted networks. A service reload or restart may be required for changes to take effect."}, "name": "CVE-2026-3591", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "bind9.16", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "bind9.18", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-03-25T13:34:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3591\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3591\nhttps://downloads.isc.org/isc/bind9/9.20.21\nhttps://downloads.isc.org/isc/bind9/9.21.20\nhttps://kb.isc.org/docs/cve-2026-3591"], "statement": "This vulnerability has a Moderate impact. A use-after-return flaw in the `named` server of `bind9` allows a remote attacker to send a specially-crafted DNS request signed with SIG(0). This can lead to improper Access Control List (ACL) matching, potentially granting unauthorized access to resources. Red Hat Enterprise Linux 8 and 9 ship with BIND versions 9.16 and 9.18 respectively, which are not affected by this flaw. Red Hat Enterprise Linux 10 is affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.0,9.20.20]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.21.0,9.21.19]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.9-S1,9.20.20-S1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[9.18.0,9.18.46]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[9.18.11-S1,9.18.46-S1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BIND 9", "source": "cna", "vendor": "ISC"}, "product": "bind", "vendor": "isc"}], "analysis": {"en": {"generated_at": "2026-03-26T04:23:50.152437+00:00", "value": {"mitigation_remediation": ["Upgrade to one of the ISC\u2011released patched BIND versions 9.20.21, 9.21.20, or 9.20.21\u2011S1"], "summary": {"action": "Immediate Patch", "impact": "Acl Bypass, Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts ISC BIND 9 DNS server versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and the 9.20.9\u2011S1 through 9.20.20\u2011S1 releases. Versions 9.18.0\u20139.18.46 and 9.18.11\u2011S1\u20139.18.46\u2011S1 are not affected.", "description_and_impact": "A use\u2011after\u2011return flaw exists in the named DNS server when processing SIG(0) signed queries. By sending a specially crafted DNS request, an attacker can cause the server to mis\u2011match an IP address against an ACL. In configurations that allow all traffic except for explicitly denied addresses, this flaw could let the attacker bypass access controls and gain unauthorized access.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the flaw is not listed in CISA\u2019s KEV catalog. The flaw can be triggered by any remote DNS query that reaches the vulnerable server, which an attacker can generate from any network with access to the server. Successful exploitation would result in ACL mis\u2011matching, allowing traffic that should be denied, potentially enabling unauthorized access to services behind the DNS server. The risk is present in deployments that rely on default\u2011allow ACLs and does not require local compromise of the system."}}}}, "created": "2026-03-25T21:31:09.549045+00:00", "updated": "2026-03-26T12:13:25.313394+00:00", "vendors": ["isc", "isc$PRODUCT$bind"]}