CVE-2026-13204

HIGH 7.5

Unexpected exit in certain situations with NSEC and NSEC3 both present

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CWE	CWE-617
Vendor	isc
Product	bind 9
Published	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for isc bind 9

Be the first to know when new high vulnerabilities affecting isc bind 9 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

ISC / BIND 9

9.11.0 ≤ 9.18.50 9.20.0 ≤ 9.20.24 9.21.0 ≤ 9.21.23 9.11.3-S1 ≤ 9.18.50-S1 9.20.9-S1 ≤ 9.20.24-S1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

kb.isc.org: https://kb.isc.org/docs/cve-2026-13204 downloads.isc.org: https://downloads.isc.org/isc/bind9/9.20.26 downloads.isc.org: https://downloads.isc.org/isc/bind9/9.21.24

Credits

ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention.