CVE-2026-3591

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Description

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Scores

Faiblesses (CWE)

• CWE-562
• CWE-305

Références européennes

• ENISA EUVD · EUVD-2026-15413
• GCVE · GCVE-0-2026-3591

Avis du CERT-FR

• CERTFR-2026-AVI-0386 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0360 — Multiples vulnérabilités dans ISC BIND · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.20.0 < 9.20.21
• cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.21.0 < 9.21.20

Produits affectés

Références

• https://kb.isc.org/docs/cve-2026-3591
• https://downloads.isc.org/isc/bind9/9.20.21
• https://downloads.isc.org/isc/bind9/9.21.20

Sources