CVE-2026-78301 Out-of-zone database nodes can become authoritative zone cuts
Attackers can inject malformed zones to create fake zone cuts, causing BIND to cache incorrect data and bypass authoritative checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78301?
CVE-2026-78301 is a medium-severity vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-349
Which versions are affected by CVE-2026-78301?
How do I fix CVE-2026-78301?
Apply the vendor's patch.
Is CVE-2026-78301 being exploited?
There is no known exploitation of CVE-2026-78301 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-78301, AZL-103332, BELL-CVE-2026-78301, CLSA-2026-1792630839, DEBIAN-CVE-2026-78301, ECHO-1eea-cbca-9338 and 5 more.