PT-2026-27775 · Isc · Bind

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-3591

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BIND versions 9.20.0 through 9.20.20 BIND versions 9.21.0 through 9.21.19 BIND versions 9.20.9-S1 through 9.20.20-S1

Description A use-after-return issue exists in the named server when processing DNS queries signed with SIG(0). A crafted DNS request could cause an Access Control List (ACL) to incorrectly match an IP address. In a default-allow ACL, this may result in unauthorized access.

Recommendations Update BIND to a version later than 9.20.20. Update BIND to a version later than 9.21.19. Update BIND to a version later than 9.20.20-S1.

Fix

Weakness Enumeration

CWE-305

CWE-562

Related Identifiers

CVE-2026-3591

Affected Products

Bind

References · 5

• https://downloads.isc.org/isc/bind9/9.21.20 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3591 · Security Note
• https://kb.isc.org/docs/cve-2026-3591 · Vendor Advisory
• https://downloads.isc.org/isc/bind9/9.20.21 · Patch
• https://twitter.com/cyberbivash/status/2036854378670227689 · Twitter Post