CVE-2026-19033: BIND 9 Information Disclosure Vulnerability

CVE-2026-19033 Overview

CVE-2026-19033 affects the Internet Systems Consortium (ISC) BIND 9 DNS server. The named daemon may begin serving zone data received during a Transaction Signature (TSIG) protected zone transfer before the final message containing the TSIG signature arrives. An attacker without a valid TSIG key can push unauthorized zone contents to a secondary server. Even when no signature ever arrives, named fails to roll back to the pre-transfer state. Exploitation requires a multi-message TCP incremental zone transfer (IXFR) as described in RFC 8945. The flaw maps to [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

Critical Impact
Successful exploitation allows attackers to inject unauthorized DNS records into a secondary zone, enabling DNS response manipulation and potential redirection of client traffic.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition versions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19033 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19033

Vulnerability Analysis

BIND 9 secondary servers use TSIG to authenticate zone transfers from primaries. RFC 8945 permits multi-message TCP IXFR responses where the TSIG signature covers the entire transaction and appears on the final message. The named implementation applies incoming records to the zone as they are received rather than deferring commitment until the final TSIG verification completes. When the final TSIG signature never arrives, or fails verification, named does not discard the partially applied records. The secondary then serves attacker-supplied DNS data as if it were authenticated.

Root Cause

The root cause is improper trust handling of unverified transfer data. The server accepts and commits IXFR record updates before the transaction-wide TSIG signature has been validated. There is no rollback path that reverts the zone to its prior state when authentication ultimately fails or is absent. This is a classic instance of [CWE-349], where trusted (authenticated) data and untrusted (pre-verification) data are mixed within the same processing pipeline.

Attack Vector

An attacker must be positioned to deliver a crafted multi-message TCP IXFR response to the vulnerable secondary. This typically requires impersonation of the configured primary or on-path interception of the TCP transfer connection. The attacker sends valid-looking IXFR messages containing malicious zone contents and terminates the connection before providing a valid final TSIG. The secondary retains the injected records and answers queries with attacker-controlled data. The Common Vulnerabilities and Exposures record indicates high attack complexity and no authentication requirement.

No verified proof-of-concept code is publicly available. Refer to the ISC CVE-2026-19033 Documentation for authoritative technical detail.

Detection Methods for CVE-2026-19033

Indicators of Compromise

Unexpected serial number changes or record additions in secondary zones not reflected on the primary.
Zone transfer TCP sessions that terminate before completion but result in updated zone content on the secondary.
DNS responses from a secondary that diverge from the authoritative primary for the same zone.

Detection Strategies

Compare zone contents and serials between primary and secondary servers on a scheduled basis and alert on divergence.
Enable and centralize BIND query and transfer logging (xfer-in, xfer-out, security channels) and correlate transfer completion status with TSIG verification outcomes.
Inspect network telemetry for IXFR sessions originating from IP addresses that are not configured primaries.

Monitoring Recommendations

Ingest BIND logs into a centralized analytics platform and build detections for aborted transfers followed by zone content changes.
Monitor for anomalous DNS answers using passive DNS or resolver telemetry to catch injected records early.
Alert on TCP resets or premature FINs on port 53 between secondaries and their configured primaries.

How to Mitigate CVE-2026-19033

Immediate Actions Required

Upgrade BIND 9 to a fixed release before exposing secondary servers to untrusted networks.
Restrict which hosts may initiate zone transfers to a secondary using firewall rules and the allow-notify and masters configuration directives.
Audit all secondary zones for unexpected records and reload from the authoritative primary if tampering is suspected.

Patch Information

ISC has released fixed builds in the ISC BIND 9.20.29 Release and the ISC BIND 9.21.26 Release. Administrators running the 9.18 branch, 9.11 branch, or Supported Preview Edition (-S1) builds should consult the ISC CVE-2026-19033 Documentation for the appropriate remediation package.

Workarounds

Where feasible, disable IXFR on affected secondaries and force full AXFR transfers, which are not subject to the multi-message TSIG timing issue described in the advisory.
Terminate primary-to-secondary transfers over a mutually authenticated transport such as an IPsec tunnel or dedicated management VLAN to prevent on-path injection.
Tighten allow-transfer and allow-notify access control lists to only the specific IP addresses of authorized primaries.

bash

# Example BIND named.conf hardening for a secondary zone
zone "example.com" {
    type secondary;
    masters { 192.0.2.10 key transfer-key; };
    allow-notify { 192.0.2.10; };
    allow-transfer { none; };
    request-ixfr no;   # prefer AXFR until patched
};