CVE-2026-3591: BIND 9 Privilege Escalation Vulnerability

CVE-2026-3591 Overview

A use-after-return vulnerability exists in the ISC BIND named server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an Access Control List (ACL) to improperly match an IP address. In a default-allow ACL configuration (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.

Critical Impact

Attackers can bypass IP-based access controls in BIND DNS servers configured with default-allow ACLs, potentially gaining unauthorized access to DNS services and resources.

Affected Products

• BIND 9 versions 9.20.0 through 9.20.20
• BIND 9 versions 9.21.0 through 9.21.19
• BIND 9 versions 9.20.9-S1 through 9.20.20-S1

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-3591 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-3591

Vulnerability Analysis

This vulnerability is classified under CWE-305 (Authentication Bypass by Primary Weakness). The use-after-return condition occurs within the named server's handling of SIG(0)-signed DNS queries. When processing these specially-crafted requests, the server may reference memory on the stack after the function has returned, leading to unpredictable behavior in ACL evaluation.

The vulnerability specifically affects how IP addresses are matched against ACL rules. When an attacker sends a malformed SIG(0)-signed DNS query, the ACL evaluation logic may use stale stack data, causing IP addresses to be incorrectly matched or mismatched against ACL entries.

The network-based attack vector allows remote exploitation without user interaction, though authentication is required. The impact primarily affects confidentiality and integrity through unauthorized access to DNS services.

Root Cause

The root cause is a use-after-return memory safety issue in the SIG(0) query processing code path. When the named server processes DNS queries with SIG(0) signatures, certain stack-allocated variables are referenced after the function scope ends. This results in ACL matching logic operating on corrupted or unpredictable memory contents, leading to authentication bypass conditions where IP-based restrictions may be incorrectly evaluated.

Attack Vector

The attack requires network access to a vulnerable BIND server. An attacker can exploit this vulnerability by:

1. Crafting a DNS query with a specially-constructed SIG(0) signature
2. Sending the malicious query to a target BIND named server
3. Triggering the use-after-return condition during ACL evaluation
4. Bypassing IP-based access restrictions if the server uses a default-allow ACL configuration

The vulnerability specifically targets the authentication and authorization mechanism within BIND's ACL processing. Servers configured with default-deny ACLs are less impacted as they fail-secure, while default-allow configurations are vulnerable to unauthorized access.

For detailed technical information about the exploitation mechanism, refer to the ISC CVE-2026-3591 Documentation.

Detection Methods for CVE-2026-3591

Indicators of Compromise

• Unusual DNS queries with SIG(0) signatures from unexpected source IP addresses
• DNS server log entries showing ACL evaluation anomalies or unexpected access grants
• Increased volume of signed DNS queries targeting the named server
• Access to DNS resources from IP addresses that should be blocked by ACL rules

Detection Strategies

• Monitor DNS query logs for SIG(0)-signed requests from untrusted sources
• Implement network-level monitoring for anomalous DNS traffic patterns
• Review BIND server logs for unexpected ACL match results or authentication events
• Deploy intrusion detection rules to identify malformed SIG(0) query signatures

Monitoring Recommendations

• Enable detailed query logging in BIND configuration to capture SIG(0) signed requests
• Set up alerts for DNS access from IP addresses that should be denied by ACL rules
• Monitor for sudden changes in DNS query patterns or unauthorized zone transfers
• Implement network flow analysis to detect reconnaissance activity targeting DNS infrastructure

How to Mitigate CVE-2026-3591

Immediate Actions Required

• Upgrade BIND to version 9.20.21 or 9.21.20 immediately
• Review and audit current ACL configurations for default-allow patterns
• Consider switching to default-deny ACL configurations where possible
• Monitor DNS server logs for suspicious SIG(0) query activity until patching is complete

Patch Information

ISC has released patched versions that address this vulnerability. Organizations should upgrade to:

• BIND 9.20.21 for the 9.20.x branch
• BIND 9.21.20 for the 9.21.x branch

Note that BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected by this vulnerability.

For complete details, consult the ISC CVE-2026-3591 Documentation.

Workarounds

• Implement default-deny ACL configurations instead of default-allow patterns
• Restrict network access to the DNS server using firewall rules at the perimeter
• Disable SIG(0) support if not required for your environment
• Use additional authentication mechanisms for sensitive DNS operations

# Example: Convert default-allow ACL to default-deny configuration
# Before (vulnerable pattern):
# acl "trusted" { !192.168.1.100; any; };

# After (fail-secure pattern):
# acl "trusted" { 10.0.0.0/8; 172.16.0.0/12; };
# 
# In named.conf, use explicit allow lists:
# allow-query { trusted; };
# allow-transfer { none; };