Is CVE-2026-3119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3119 being exploited in the wild.

How severe is CVE-2026-3119?

Medium severity, with a CVSS score of 6.5, published 25 March 2026.

Which products and versions are affected?

Isc BIND 9 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.20.9-S1 through 9.20.20-S1.

Is there a fix for CVE-2026-3119?

A patch was published on 2026-03-25: Patched versions 9.20.21 and 9.21.20 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3119 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-3119?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3119: ISC BIND 9 denial of service via TKEY record in authenticated query

CVE-2026-3119 · Severity: medium · CVSS 6.5 · Published 2026-03-25

A vulnerability in BIND 9, a widely used DNS server software, can cause the service to crash and become unavailable. An attacker with valid credentials (TSIG keys) can send a specially crafted request that triggers this failure. This results in a denial-of-service, potentially disrupting internet connectivity or internal network resolution for the organization.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-3119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3119 being exploited in the wild.
How severe is CVE-2026-3119?: Medium severity, with a CVSS score of 6.5, published 25 March 2026.
Which products and versions are affected?: Isc BIND 9 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.20.9-S1 through 9.20.20-S1.
Is there a fix for CVE-2026-3119?: A patch was published on 2026-03-25: Patched versions 9.20.21 and 9.21.20 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3119 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-3119?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reachable assertion (CWE-617) exists in the 'named' component of BIND 9 when processing TKEY records. The vulnerability is triggered when a correctly signed query containing a TKEY record is processed under specific conditions. Exploitation requires the attacker to possess a valid Transaction Signature (TSIG) key that is already declared in the server's configuration. Successful exploitation results in the immediate termination of the 'named' process, affecting both authoritative servers and resolvers. Patches are available in versions 9.20.21 and 9.21.20.

Affected products

ISC BIND 9 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.20.9-S1 through 9.20.20-S1

Timeline

2026-03-18: other: Early notification provided
2026-03-25: disclosed: Public disclosure and advisory published
2026-03-25: patched: Patched versions 9.20.21 and 9.21.20 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.