CVE-2026-75029

{
  "id": "CVE-2026-75029",
  "sourceIdentifier": "[email protected]",
  "published": "2026-09-16T15:17:43.577",
  "lastModified": "2026-10-26T23:10:00.183",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."
    },
    {
      "lang": "es",
      "value": "En una respuesta de consulta, un atacante puede enviar “named” múltiples copias de un registro que solo debería existir una vez (como un registro SOA). Si el RDATA es idéntico en todas las copias, el registro se agrega al conjunto RDATA en memoria, lo que puede provocar un aumento del uso de memoria de la caché negativa y posiblemente conducir a otros vectores de ataque de memoria. Este problema afecta a BIND?9 versiones 9.11.0 hasta 9.18.50 incluidas, 9.20.0 hasta 9.20.27 incluidas, 9.21.0 hasta 9.21.25 incluidas, 9.11.3?S1 hasta 9.18.50?S1 incluidas, y 9.20.9?S1 hasta 9.20.27?S1 incluidas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ISC",
          "product": "BIND 9",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.11.0",
              "lessThanOrEqual": "9.18.50",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.20.0",
              "lessThanOrEqual": "9.20.27",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.21.0",
              "lessThanOrEqual": "9.21.25",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.11.3-S1",
              "lessThanOrEqual": "9.18.50-S1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.20.9-S1",
              "lessThanOrEqual": "9.20.27-S1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-17T18:40:03.771347Z",
          "id": "CVE-2026-75029",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://downloads.isc.org/isc/bind9/9.20.29",
      "source": "[email protected]"
    },
    {
      "url": "https://downloads.isc.org/isc/bind9/9.21.26",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.isc.org/docs/cve-2026-75029",
      "source": "[email protected]"
    }
  ]
}