CVE-2026-78301— Out-of-zone database nodes can become authoritative zone cuts
Quick assessment
Affected
ISC BIND 9
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是对该漏洞描述信息的中文翻译： 漏洞描述翻译： 畸形区域（zone）可能在其起始点（origin）之上包含 NS 或 DNAME 节点， 会将其视为区域切割（zone cut）。如果攻击者通过区域传输（zone transfer）等途径向 BIND 权威服务器插入一个畸形区域，那么针对已配置区域内的名称的查询将失去权威性状态，并返回一个区域外的委派（out-of-zone delegation）。对于同时提供递归解析服务的 BIND 服务器，可能会跟随这个源自本地的切割点，并将攻击者提供的数据缓存起来，从而影响
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1598 · Phishing for Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78301
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-zone database nodes can become authoritative zone cuts
Source: CVE Program / CVE List V5
Vulnerability Description
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-78301
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78301
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78301 (1)
Vendor Pages for CVE-2026-78301 (2)
Same Patch Batch · ISC · 2026-09-16 · 14 CVEs total
| CVE-2026-81736 | 7.5 HIGH | Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees |
| CVE-2026-19667 | 7.5 HIGH | Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` |
| CVE-2026-77692 | 7.5 HIGH | Unauthenticated remote crash of named via a single DoH SIG(0) request |
| CVE-2026-81563 | 7.5 HIGH | SVCB AliasMode additional-data error leaks qpcache references |
| CVE-2026-19666 | 7.5 HIGH | Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path |
| CVE-2026-80274 | 7.5 HIGH | Validating resolver can abort while caching a mismatched NOQNAME proof |
| CVE-2026-76163 | 7.5 HIGH | named aborts on a TKEY query when the user configuration has no global options statement |
| CVE-2026-19033 | 6.5 MEDIUM | Unauthenticated IXFR deltas are applied to the live zone before TSIG verification |
| CVE-2026-19662 | 5.9 MEDIUM | qpcache NOQNAME proof use-after-free crashes recursive resolver |
| CVE-2026-19941 | 5.9 MEDIUM | checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof |
| CVE-2026-77119 | 5.9 MEDIUM | NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets |
| CVE-2026-75029 | 5.3 MEDIUM | Message parser retains every identical singleton RDATA, enabling wire-to-work amplificatio |
| CVE-2026-19668 | 5.3 MEDIUM | Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching |
IV. Related Vulnerabilities
Same product: BIND 9
-
CVE-2026-77119
NSEC3 insecure-referral proof can use unrelated cached NSEC3 -
CVE-2026-75029
Message parser retains every identical singleton RDATA, enab -
CVE-2026-19668
Resource Exhaustion via Excessive DNSSEC Cryptographic Mater -
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-80274
Validating resolver can abort while caching a mismatched NOQ
Same vendor: ISC
-
CVE-2026-77119
NSEC3 insecure-referral proof can use unrelated cached NSEC3 -
CVE-2026-75029
Message parser retains every identical singleton RDATA, enab -
CVE-2026-19668
Resource Exhaustion via Excessive DNSSEC Cryptographic Mater -
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-80274
Validating resolver can abort while caching a mismatched NOQ
Same weakness: CWE-349
-
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers -
CVE-2026-50252
Possible cache poisoning attack by mapping source port popul -
CVE-2026-41120
Dell Wyse Management Suite 信任管理问题漏洞
V. Comments for CVE-2026-78301
No comments yet