Description
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND 9 | 9.20.0 – ≤ 9.20.20, 9.21.0 – ≤ 9.21.19, 9.20.9-S1 – ≤ 9.20.20-S1 | 9.18.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.20.21-1 | — |
| Debian 13 | bind9 | 1:9.20.21-1~deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | isc-dhcp | No fix yet | — |
| Ubuntu 25.10 | bind9 | 1:9.20.11-1ubuntu2.2 | — |
| Ubuntu 25.10 | isc-dhcp | No fix yet | — |
| Ubuntu 24.04 LTS | isc-dhcp | No fix yet | — |
| Ubuntu 22.04 LTS | bind9-libs | No fix yet | — |
| Ubuntu 20.04 LTS | bind9-libs | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | isc-dhcp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | bind +6 | 9.18.48-1.hum1 | RHSA-2026:6935 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | bind | 9.20.21-150700.3.18.1 | SUSE-SU-2026:1351-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | bind | 9.20.21-160000.1.1 | SUSE-SU-2026:21204-1 |
| SLES 16.0 | bind | 9.20.21-160000.1.1 | SUSE-SU-2026:21204-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.20.21-1.1 | openSUSE-SU-2026:10448-1 |
| openSUSE Leap 16.0 | bind | 9.20.21-160000.1.1 | openSUSE-SU-2026:20550-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.20.21-r0 | — |
| Alpine v3.23 | bind | 9.20.21-r0 | — |
| Alpine v3.22 | bind | 9.20.21-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | bind | 9.20.21-1 | — |
Advisories 6
- WID-SEC-2026-0863 Internet Systems Consortium BIND: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026
- RHSA-2026:6935 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- SUSE-SU-2026:21204-1 Security update for bind SUSE / openSUSE Security Updates · Apr 22, 2026
- openSUSE-SU-2026:20550-1 Security update for bind SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:1351-1 Security update for bind SUSE / openSUSE Security Updates · Apr 16, 2026
- openSUSE-SU-2026:10448-1 bind-9.20.21-1.1 on GA media SUSE / openSUSE Security Updates · Mar 29, 2026
References
- CVE-2026-3591 vendor-advisory
- https://downloads.isc.org/isc/bind9/9.20.21 patch
- https://downloads.isc.org/isc/bind9/9.21.20 patch