Vulnerability · Published Mar 25, 2026 · Assigned by isc

CVE-2026-3591A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Medium 5.4

In plain English

A medium-severity security flaw in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	bind	9.20.21-r0	ALPINE-CVE-2026-3591
Alpine:v3.23	bind	9.20.21-r0	ALPINE-CVE-2026-3591
Alpine:v3.24	bind	9.20.21-r0	ALPINE-CVE-2026-3591
Debian:13	bind9	1:9.20.21-1~deb13u1	DEBIAN-CVE-2026-3591
Debian:14	bind9	1:9.20.21-1	DEBIAN-CVE-2026-3591
Ubuntu:25.10	bind9	1:9.20.11-1ubuntu2.2	UBUNTU-CVE-2026-3591
Ubuntu:22.04:LTS	bind9-libs	no fix listed	UBUNTU-CVE-2026-3591
Ubuntu:24.04:LTS	isc-dhcp	no fix listed	UBUNTU-CVE-2026-3591
Ubuntu:25.10	isc-dhcp	no fix listed	UBUNTU-CVE-2026-3591
Ubuntu:26.04:LTS	isc-dhcp	no fix listed	UBUNTU-CVE-2026-3591

Affected products (as reported)

Vendor	Product	Versions
ISC	BIND 9	9.20.0 – through 9.20.209.21.0 – through 9.21.199.20.9-S1 – through 9.20.20-S1

Weakness: CWE-562, CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

CVE-2026-3591 vendor-advisory
https://downloads.isc.org/isc/bind9/9.20.21 patch
https://downloads.isc.org/isc/bind9/9.21.20 patch