CVE-2026-13204

HIGH7.5

Unexpected exit in certain situations with NSEC and NSEC3 both present

Published Jul 22, 2026

Modified 1 months ago

Details

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

References

FIX

https://downloads.isc.org/isc/bind9/9.20.26

FIX

https://downloads.isc.org/isc/bind9/9.21.24

ADVISORY

https://kb.isc.org/docs/cve-2026-13204

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-13204

CVSS Analysis

CVSS v3.1

7.5