CVE-2026-77119

{
  "id": "CVE-2026-77119",
  "sourceIdentifier": "[email protected]",
  "published": "2026-09-16T15:17:46.427",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."
    },
    {
      "lang": "es",
      "value": "Un NSEC3 firmado válidamente proveniente de una zona hermana no relacionada puede ser aceptado como prueba de inseguridad, degradando una delegación segura y permitiendo que una respuesta falsificada sin firma pase.  \\nEste problema afecta a BIND?9 desde la versión 9.11.0 hasta la versión 9.18.50 incluida, desde la versión 9.20.0 hasta la versión 9.20.27 incluida, desde la versión 9.21.0 hasta la versión 9.21.25 incluida, desde la versión 9.11.3?S1 hasta la versión 9.18.50?S1 incluida, y desde la versión 9.20.9?S1 hasta la versión 9.20.27?S1 incluida."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ISC",
          "product": "BIND 9",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.11.0",
              "lessThanOrEqual": "9.18.50",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.20.0",
              "lessThanOrEqual": "9.20.27",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.21.0",
              "lessThanOrEqual": "9.21.25",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.11.3-S1",
              "lessThanOrEqual": "9.18.50-S1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.20.9-S1",
              "lessThanOrEqual": "9.20.27-S1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-17T18:39:32.807057Z",
          "id": "CVE-2026-77119",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://downloads.isc.org/isc/bind9/9.20.29",
      "source": "[email protected]"
    },
    {
      "url": "https://downloads.isc.org/isc/bind9/9.21.26",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.isc.org/docs/cve-2026-77119",
      "source": "[email protected]"
    }
  ]
}