CVE-2026-19033— Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
Quick assessment
Affected
ISC BIND 9
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
对于通过 TSIG 限制区域传输的辅助区域， 服务可能在收到带有 TSIG 签名的最终消息之前，就开始提供区域传输中携带的数据。这可能使未持有有效 TSIG 签名的攻击者能够向辅助服务器发送未经授权的区域内容。即使始终未收到 TSIG 签名， 也不会回滚到传输前的状态。要利用此漏洞，区域传输必须是一个多消息的 TCP IXFR 传输，如 RFC 8945 中所述。 此问题影响 BIND 9 的版本范围如下： 9.11.0 至 9.18.50 9.20.0 至 9.20.27 9.21.0 至 9.21.25 9.1
Possible ATT&CK Techniques 3 AI
T1499 · Endpoint Denial of Service T1598 · Phishing for Information T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
Source: CVE Program / CVE List V5
Vulnerability Description
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-19033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19033
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19033 (1)
Vendor Pages for CVE-2026-19033 (2)
Same Patch Batch · ISC · 2026-09-16 · 14 CVEs total
| CVE-2026-81736 | 7.5 HIGH | Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees |
| CVE-2026-19667 | 7.5 HIGH | Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` |
| CVE-2026-77692 | 7.5 HIGH | Unauthenticated remote crash of named via a single DoH SIG(0) request |
| CVE-2026-81563 | 7.5 HIGH | SVCB AliasMode additional-data error leaks qpcache references |
| CVE-2026-19666 | 7.5 HIGH | Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path |
| CVE-2026-80274 | 7.5 HIGH | Validating resolver can abort while caching a mismatched NOQNAME proof |
| CVE-2026-76163 | 7.5 HIGH | named aborts on a TKEY query when the user configuration has no global options statement |
| CVE-2026-19662 | 5.9 MEDIUM | qpcache NOQNAME proof use-after-free crashes recursive resolver |
| CVE-2026-19941 | 5.9 MEDIUM | checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof |
| CVE-2026-77119 | 5.9 MEDIUM | NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets |
| CVE-2026-78301 | 5.8 MEDIUM | Out-of-zone database nodes can become authoritative zone cuts |
| CVE-2026-75029 | 5.3 MEDIUM | Message parser retains every identical singleton RDATA, enabling wire-to-work amplificatio |
| CVE-2026-19668 | 5.3 MEDIUM | Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching |
IV. Related Vulnerabilities
Same product: BIND 9
-
CVE-2026-77119
NSEC3 insecure-referral proof can use unrelated cached NSEC3 -
CVE-2026-75029
Message parser retains every identical singleton RDATA, enab -
CVE-2026-19668
Resource Exhaustion via Excessive DNSSEC Cryptographic Mater -
CVE-2026-80274
Validating resolver can abort while caching a mismatched NOQ -
CVE-2026-76163
named aborts on a TKEY query when the user configuration has
Same vendor: ISC
-
CVE-2026-77119
NSEC3 insecure-referral proof can use unrelated cached NSEC3 -
CVE-2026-75029
Message parser retains every identical singleton RDATA, enab -
CVE-2026-19668
Resource Exhaustion via Excessive DNSSEC Cryptographic Mater -
CVE-2026-80274
Validating resolver can abort while caching a mismatched NOQ -
CVE-2026-76163
named aborts on a TKEY query when the user configuration has
Same weakness: CWE-349
-
CVE-2026-78301
Out-of-zone database nodes can become authoritative zone cut -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers -
CVE-2026-50252
Possible cache poisoning attack by mapping source port popul -
CVE-2026-41120
Dell Wyse Management Suite 信任管理问题漏洞
V. Comments for CVE-2026-19033
No comments yet