Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-13204

Unexpected exit in certain situations with NSEC and NSEC3 both present

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND 9

Default version status: unaffected

  • 9.11.0 to ≤ 9.18.50affected
  • 9.20.0 to ≤ 9.20.24affected
  • 9.21.0 to ≤ 9.21.23affected
  • 9.11.3-S1 to ≤ 9.18.50-S1affected
  • 9.20.9-S1 to ≤ 9.20.24-S1affected

References