CVE-2026-77119 NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets
Attackers can bypass DNSSEC validation by using unrelated cached NSEC3 records to forge unsigned answers, affecting BIND 9 users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77119?
CVE-2026-77119 is a medium-severity vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-346
Which versions are affected by CVE-2026-77119?
How do I fix CVE-2026-77119?
Apply the vendor's patch.
Is CVE-2026-77119 being exploited?
There is no known exploitation of CVE-2026-77119 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-77119, AZL-103341, BELL-CVE-2026-77119, DEBIAN-CVE-2026-77119, ECHO-13f4-9e5a-3fae, GHSA-r3pf-h3x3-rv3w and 6 more.