# CVE-2026-78301: ISC BIND named zone parsing vulnerability

Source: https://junglewise.ai/threats/cve-2026-78301-isc-bind-named-zone-parsing-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78301 · Severity: medium · CVSS 5.8 · Published 2026-09-16

BIND is the most widely deployed DNS server software used by internet service providers and enterprises to host DNS zones. A malformed zone file containing improperly placed NS or DNAME records can cause the DNS server to mishandle queries and, on recursive resolvers, cache incorrect DNS data. This allows an attacker who can upload a malformed zone to inject false DNS records that affect external domains, potentially enabling phishing, malware distribution, or service disruption.

Technologies: [Isc Bind](https://junglewise.ai/threats/technologies/bind). Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-78301 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78301 being exploited in the wild.

**How severe is CVE-2026-78301?** Medium severity, with a CVSS score of 5.8, published 16 September 2026.

**Which products and versions are affected?** Isc Bind 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1.

**Is there a fix for CVE-2026-78301?** A patch was published on 2026-09-16: Patches released in BIND 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78301 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-78301?** Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a zone parsing flaw in BIND's named server where a malformed zone containing an NS or DNAME node above its origin is incorrectly treated as a zone cut. An attacker can exploit this by inserting a malformed zone via zone transfer (AXFR) or similar mechanisms. On authoritative-only servers, queries lose their authoritative status and return out-of-zone delegations; on servers that also provide recursive resolution, BIND follows these locally-sourced cuts, caches attacker-supplied data, and can poison the cache with false records for domains outside the configured zone. The issue persists until the malformed zone is removed from the database. Patches are available in BIND 9.20.29, 9.21.26, and corresponding BIND 9 ESV releases.

## Affected products

- ISC BIND 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1

## Timeline

- 2026-09-16: disclosed: CVE-2026-78301 published
- 2026-09-16: patched: Patches released in BIND 9.20.29 and 9.21.26

## References

- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)
- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)

## Related threats

- [BIND assertion failure with redirect zone and qname-minimization](https://junglewise.ai/threats/cve-2026-96888-a-bind-resolver-that-is-configured-with-both-a-redirect-zone-and)
- [BIND named GSS-TSIG replay heap corruption](https://junglewise.ai/threats/cve-2026-94300-replaying-gss-tsig-signed-udp-messages-can-result-in-memory)
- [ISC BIND resolver DNS message processing denial of service](https://junglewise.ai/threats/cve-2026-19630-in-a-bind-resolver-inbound-dns-protocol-messages-with-a)
- [ISC BIND denial of service via TKEY queries](https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability)
- [BIND resolver crash on DNSSEC-signed wildcard with NSEC mismatch](https://junglewise.ai/threats/cve-2026-80274-bind-resolver-crash-on-dnssec-signed-wildcard-with-nsec-mismatch)