Executive brief
BIND is the most widely deployed DNS server software used by internet service providers and enterprises to host DNS zones. A malformed zone file containing improperly placed NS or DNAME records can cause the DNS server to mishandle queries and, on recursive resolvers, cache incorrect DNS data. This allows an attacker who can upload a malformed zone to inject false DNS records that affect external domains, potentially enabling phishing, malware distribution, or service disruption.
Technical details
The vulnerability is a zone parsing flaw in BIND's named server where a malformed zone containing an NS or DNAME node above its origin is incorrectly treated as a zone cut. An attacker can exploit this by inserting a malformed zone via zone transfer (AXFR) or similar mechanisms. On authoritative-only servers, queries lose their authoritative status and return out-of-zone delegations; on servers that also provide recursive resolution, BIND follows these locally-sourced cuts, caches attacker-supplied data, and can poison the cache with false records for domains outside the configured zone. The issue persists until the malformed zone is removed from the database. Patches are available in BIND 9.20.29, 9.21.26, and corresponding BIND 9 ESV releases.
Affected products
- ISC BIND 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1
Timeline
- 2026-09-16: disclosed: CVE-2026-78301 published
- 2026-09-16: patched: Patches released in BIND 9.20.29 and 9.21.26