CVE-2026-19941 in BIND
Summary
by MITRE • 09/16/2026
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves a flaw in the DNS resolution logic within BIND named resolvers that allows for an NSEC record masking attack against wildcard records. In the Domain Name System, NSEC (Next Secure) and NSEC3 records are used to provide authenticated denial of existence, proving that a queried name does not exist or that no wildcards cover it. This mechanism is critical for DNS Security Extensions (DNSSEC), ensuring that resolvers can trust negative responses from authoritative servers. However, the identified flaw permits an attacker who controls a zone at the same level as the victim's wildcard record or one of its upstream zones to craft specific NSEC records that are incorrectly accepted by vulnerable BIND versions as valid proof that no wildcard exists for a target domain name. This misinterpretation stems from insufficient validation logic when processing these denial-of-existence proofs, allowing maliciously constructed data to bypass standard security checks designed to prevent such spoofing scenarios.
The operational impact of this vulnerability is significant because it enables an attacker to effectively hide the existence of a victim's wildcard DNS record. Wildcard records are commonly used by organizations to map all subdomains under a specific domain to a single IP address or service, simplifying configuration and management. By successfully masking these records through the exploitation of the NSEC validation flaw, an attacker can redirect traffic intended for legitimate services hosted on those wildcards to infrastructure controlled by the adversary. This capability facilitates various malicious activities including phishing campaigns where users are directed to fraudulent sites mimicking the victim's domain, man-in-the-middle attacks that intercept sensitive communications, and general service disruption by preventing access to critical web applications or APIs relying on wildcard DNS configurations. The attack requires the attacker to be positioned at a specific level within the zone hierarchy relative to the target, either controlling an upstream authoritative server or having influence over the delegation path used during resolution.
From a technical perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions as defined by Common Weakness Enumeration standards. The resolver fails to correctly evaluate the applicability of NSEC records in contexts involving wildcard expansions, leading to an incorrect determination that a name is non-existent despite the presence of covering wildcards. In terms of cyber threat intelligence frameworks such as MITRE ATT&CK for Enterprise and ICS, this behavior corresponds to techniques related to DNS Tunneling or Domain Generation Algorithm evasion strategies where attackers manipulate DNS resolution paths to bypass security controls. Specifically it reflects aspects of Defense Evasion by obscuring the true nature of network communications and potentially Data Exfiltration if used in conjunction with other exploits to leak data via disguised queries. The flaw highlights a critical gap in how resolvers handle edge cases within DNSSEC validation processes, particularly when dealing with complex zone cut scenarios or overlapping wildcard definitions across different levels of the domain tree.
Mitigation strategies primarily involve updating BIND software to patched versions that address this specific logic error in NSEC record processing. Administrators should ensure their systems are running BIND 9 version 9.18.51 or later, 9.20.28 or later, or 9.21.26 or later depending on the branch in use. For those using Service Pack variants such as the S1 series, updates to versions beyond 9.18.50-S1 and 9.20.27-S1 are required respectively. In addition to software patching organizations should implement robust DNS monitoring solutions capable of detecting anomalous query patterns indicative of NSEC-based masking attempts or unusual redirections stemming from compromised wildcard records. Regular audits of zone configurations can also help identify overly permissive wildcards that might increase the attack surface, while deploying additional security layers like DNS firewalls and response policy zones provides defense-in-depth against such resolution manipulation attacks ensuring continuity of service integrity even if underlying resolver vulnerabilities are exploited before patches are applied.