CVE-2026-3591 (GCVE-0-2026-3591)

Vulnerability from cvelistv5 – Published: 2026-03-25 13:34 – Updated: 2026-03-25 14:13
VLAI
Title
A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass
Summary
A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-562 - Return of Stack Variable Address
  • CWE-305 - Authentication Bypass by Primary Weakness
Assigner
isc
References
Impacted products
Vendor Product Version
ISC BIND 9 Affected: 9.20.0 , ≤ 9.20.20 (custom)
Affected: 9.21.0 , ≤ 9.21.19 (custom)
Affected: 9.20.9-S1 , ≤ 9.20.20-S1 (custom)
Unaffected: 9.18.0 , ≤ 9.18.46 (custom)
Unaffected: 9.18.11-S1 , ≤ 9.18.46-S1 (custom)
Create a notification for this product.
Date Public
2026-03-25 00:00
Credits
ISC would like to thank Mcsky23 for bringing this vulnerability to our attention.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T14:12:43.295485Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T14:13:01.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BIND 9",
          "vendor": "ISC",
          "versions": [
            {
              "lessThanOrEqual": "9.20.20",
              "status": "affected",
              "version": "9.20.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.21.19",
              "status": "affected",
              "version": "9.21.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.20.20-S1",
              "status": "affected",
              "version": "9.20.9-S1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.18.46",
              "status": "unaffected",
              "version": "9.18.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.18.46-S1",
              "status": "unaffected",
              "version": "9.18.11-S1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.20.20",
                  "versionStartIncluding": "9.20.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.21.19",
                  "versionStartIncluding": "9.21.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.20.20-S1",
                  "versionStartIncluding": "9.20.9-S1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.18.46",
                  "versionStartIncluding": "9.18.0",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.18.46-S1",
                  "versionStartIncluding": "9.18.11-S1",
                  "vulnerable": false
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ISC would like to thank Mcsky23 for bringing this vulnerability to our attention."
        }
      ],
      "datePublic": "2026-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "We are not aware of any active exploits."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker may be able to cause an ACL to improperly (mis)match an IP address.  In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-562",
              "description": "CWE-562 Return of Stack Variable Address",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-305",
              "description": "CWE-305 Authentication Bypass by Primary Weakness",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-25T13:34:14.202Z",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "name": "CVE-2026-3591",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://kb.isc.org/docs/cve-2026-3591"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://downloads.isc.org/isc/bind9/9.20.21"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://downloads.isc.org/isc/bind9/9.21.20"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workarounds known."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2026-3591",
    "datePublished": "2026-03-25T13:34:14.202Z",
    "dateReserved": "2026-03-05T12:50:58.915Z",
    "dateUpdated": "2026-03-25T14:13:01.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-3591",
      "date": "2026-05-25",
      "epss": "0.00023",
      "percentile": "0.06759"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3591\",\"sourceIdentifier\":\"security-officer@isc.org\",\"published\":\"2026-03-25T14:16:37.297\",\"lastModified\":\"2026-05-21T15:24:36.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de use-after-return existe en el servidor \u0027named\u0027 al manejar consultas DNS firmadas con SIG(0). Usando una solicitud DNS especialmente dise\u00f1ada, un atacante podr\u00eda ser capaz de hacer que una ACL haga una coincidencia incorrecta con una direcci\u00f3n IP. En una ACL de permiso predeterminado (negando solo direcciones IP espec\u00edficas), esto podr\u00eda llevar a acceso no autorizado. Las ACL de denegaci\u00f3n predeterminada deber\u00edan fallar de forma segura.\\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.20, 9.21.0 a 9.21.19, y 9.20.9-S1 a 9.20.20-S1.\\nLas versiones de BIND 9 9.18.0 a 9.18.46 y 9.18.11-S1 a 9.18.46-S1 NO est\u00e1n afectadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-officer@isc.org\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-officer@isc.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-305\"},{\"lang\":\"en\",\"value\":\"CWE-562\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"9.20.0\",\"versionEndExcluding\":\"9.20.21\",\"matchCriteriaId\":\"2C0EF5D0-68A6-4E00-985B-523D9B243E49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"9.21.0\",\"versionEndExcluding\":\"9.21.20\",\"matchCriteriaId\":\"B1DD0950-5CBD-49B2-8007-5E96B3C4FB1B\"}]}]}],\"references\":[{\"url\":\"https://downloads.isc.org/isc/bind9/9.20.21\",\"source\":\"security-officer@isc.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://downloads.isc.org/isc/bind9/9.21.20\",\"source\":\"security-officer@isc.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://kb.isc.org/docs/cve-2026-3591\",\"source\":\"security-officer@isc.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"404fd4d2-a609-4245-b543-2c944a302a22\", \"shortName\": \"isc\", \"dateUpdated\": \"2026-03-25T13:34:14.202Z\"}, \"title\": \"A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass\", \"datePublic\": \"2026-03-25T00:00:00.000Z\", \"affected\": [{\"vendor\": \"ISC\", \"product\": \"BIND 9\", \"versions\": [{\"version\": \"9.20.0\", \"lessThanOrEqual\": \"9.20.20\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"9.21.0\", \"lessThanOrEqual\": \"9.21.19\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"9.20.9-S1\", \"lessThanOrEqual\": \"9.20.20-S1\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"9.18.0\", \"lessThanOrEqual\": \"9.18.46\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"9.18.11-S1\", \"lessThanOrEqual\": \"9.18.46-S1\", \"status\": \"unaffected\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"cpeApplicability\": [{\"nodes\": [{\"operator\": \"OR\", \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.20.0\", \"versionEndIncluding\": \"9.20.20\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.21.0\", \"versionEndIncluding\": \"9.21.19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.20.9-S1\", \"versionEndIncluding\": \"9.20.20-S1\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.18.0\", \"versionEndIncluding\": \"9.18.46\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.18.11-S1\", \"versionEndIncluding\": \"9.18.46-S1\"}]}]}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\"}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-562\", \"description\": \"CWE-562 Return of Stack Variable Address\"}, {\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-305\", \"description\": \"CWE-305 Authentication Bypass by Primary Weakness\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.\\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker may be able to cause an ACL to improperly (mis)match an IP address.  In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access.\"}]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"No workarounds known.\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"We are not aware of any active exploits.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.21, 9.21.20, or 9.20.21-S1.\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"ISC would like to thank Mcsky23 for bringing this vulnerability to our attention.\"}], \"references\": [{\"url\": \"https://kb.isc.org/docs/cve-2026-3591\", \"name\": \"CVE-2026-3591\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://downloads.isc.org/isc/bind9/9.20.21\", \"tags\": [\"patch\"]}, {\"url\": \"https://downloads.isc.org/isc/bind9/9.21.20\", \"tags\": [\"patch\"]}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3591\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-25T14:12:43.295485Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-25T14:12:54.940Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3591\", \"assignerOrgId\": \"404fd4d2-a609-4245-b543-2c944a302a22\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"isc\", \"dateReserved\": \"2026-03-05T12:50:58.915Z\", \"datePublished\": \"2026-03-25T13:34:14.202Z\", \"dateUpdated\": \"2026-03-25T14:13:01.659Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.