CVE-2026-19941 checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof
Attackers can mask wildcard records by exploiting NSEC validation flaws in BIND, potentially hiding DNS data from resolvers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19941?
CVE-2026-19941 is a medium-severity vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-345
Which versions are affected by CVE-2026-19941?
How do I fix CVE-2026-19941?
Apply the vendor's patch.
Is CVE-2026-19941 being exploited?
There is no known exploitation of CVE-2026-19941 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-19941, AZL-103359, BELL-CVE-2026-19941, DEBIAN-CVE-2026-19941, ECHO-9873-7113-c63e, GHSA-38fx-cm5x-27pg and 4 more.