CVE-2026-77119: BIND 9 DNSSEC Information Disclosure Flaw

CVE-2026-77119 Overview

CVE-2026-77119 affects Internet Systems Consortium (ISC) BIND 9, the widely deployed DNS server. The vulnerability lies in DNSSEC validation logic. A resolver may accept a validly signed NSEC3 record from an unrelated sibling zone as proof of insecurity. This downgrades a secure delegation and lets a forged unsigned answer pass validation. The flaw maps to [CWE-346] Origin Validation Error. An attacker with a network position and the ability to influence DNS responses can inject forged data into resolver caches. The issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and multiple Supported Preview Edition (-S1) branches.

Critical Impact
Attackers can bypass DNSSEC protections on specific delegations and deliver forged DNS responses that resolvers treat as legitimate, undermining the integrity of DNS-based trust.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-77119 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77119

Vulnerability Analysis

BIND 9 uses NSEC3 records to prove the non-existence of DNS names or the absence of DNSSEC delegation records. When a resolver receives a referral that lacks a DS record, it expects NSEC or NSEC3 proof from the parent zone confirming that no DS exists. This proof authorizes the resolver to treat the child zone as insecure.

The validator does not correctly confirm that the NSEC3 record originates from the expected parent zone. A validly signed NSEC3 record from an unrelated sibling zone can satisfy the check. Once the resolver marks the delegation as insecure, DNSSEC validation is skipped for subsequent responses under that delegation. An attacker can then supply forged unsigned answers that the resolver caches and returns to clients.

Root Cause

The root cause is improper origin validation of authenticated denial-of-existence records. The validator accepts a cryptographically valid NSEC3 without verifying that the signing zone is authoritative for the delegation point being proven insecure. This is the classic pattern captured by [CWE-346].

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker must control or influence responses from an authoritative server for an unrelated zone that shares a signing relationship the resolver will accept. The attacker then races or injects a crafted response containing the sibling zone's signed NSEC3 record to prove insecurity for the target delegation. Attack complexity is high because the attacker must align the response, timing, and cryptographic material for the resolver to accept the proof.

No verified public exploit code is available. See the ISC CVE-2026-77119 Documentation for technical details.

Detection Methods for CVE-2026-77119

Indicators of Compromise

Resolver logs showing DNSSEC validation transitioning a previously secure delegation to insecure without a legitimate configuration change
NSEC3 records in cached responses whose signer name does not match the expected parent zone of the delegation
Unexpected unsigned answers returned for domains that publish DS records at their parent

Detection Strategies

Enable verbose DNSSEC logging (dnssec and resolver categories) on BIND 9 resolvers and review validation outcomes for anomalous insecurity proofs
Cross-check resolver responses against an independent validating resolver or DNSSEC lookaside service to identify divergent trust decisions
Alert on cache entries where an authenticated denial-of-existence proof references a signer outside the expected delegation chain

Monitoring Recommendations

Ingest BIND query-errors and validation logs into a centralized log platform and baseline normal NSEC3 signer distributions per delegation
Monitor for spikes in insecure validation results across zones that historically returned secure
Track BIND version inventory to identify resolvers still running affected 9.11.x through 9.21.25 builds

How to Mitigate CVE-2026-77119

Immediate Actions Required

Inventory all BIND 9 resolvers and identify instances running affected versions between 9.11.0 and 9.21.25, including Supported Preview Edition branches
Upgrade recursive resolvers to BIND 9.20.29, 9.21.26, or the corresponding patched Supported Preview Edition release
Restrict recursive DNS service to trusted clients using allow-recursion and firewall controls to reduce exposure to off-path attackers

Patch Information

ISC has released fixed builds. Upgrade to ISC BIND 9.20.29 or ISC BIND 9.21.26. Supported Preview Edition customers should obtain the corresponding -S1 patched release from ISC. Refer to the ISC CVE-2026-77119 Documentation for release-specific guidance.

Workarounds

No configuration-only workaround eliminates the flaw; upgrading to a patched release is the supported remediation
Reduce attack surface by limiting resolver reachability to internal clients and enforcing response rate limiting on authoritative servers
Deploy DNS over TLS or DNS over HTTPS between clients and resolvers to reduce opportunistic response injection on the client-facing path

bash

# Verify installed BIND version after patching
named -v

# Example allow-recursion restriction in named.conf
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
    dnssec-validation auto;
};