« Volver al listado

CVE-2026-3119

Estado: AnalizadaMedia (6.5)—

Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

ISC — Bind

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3119",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3119",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-25T14:13:41.579382Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-officer@isc.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-officer@isc.org",
      "affectedData": [
        {
          "vendor": "ISC",
          "product": "BIND 9",
          "versions": [
            {
              "status": "affected",
              "version": "9.20.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.20.20"
            },
            {
              "status": "affected",
              "version": "9.21.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.21.19"
            },
            {
              "status": "affected",
              "version": "9.20.9-S1",
              "versionType": "custom",
              "lessThanOrEqual": "9.20.20-S1"
            },
            {
              "status": "unaffected",
              "version": "9.18.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.18.46"
            },
            {
              "status": "unaffected",
              "version": "9.18.11-S1",
              "versionType": "custom",
              "lessThanOrEqual": "9.18.46-S1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-25T14:16:37.097",
  "references": [
    {
      "url": "https://downloads.isc.org/isc/bind9/9.20.21",
      "tags": [
        "Patch"
      ],
      "source": "security-officer@isc.org"
    },
    {
      "url": "https://downloads.isc.org/isc/bind9/9.21.20",
      "tags": [
        "Patch"
      ],
      "source": "security-officer@isc.org"
    },
    {
      "url": "https://kb.isc.org/docs/cve-2026-3119",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-officer@isc.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-officer@isc.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.\nBIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected."
    },
    {
      "lang": "es",
      "value": "Bajo ciertas condiciones, 'named' puede colapsar al procesar una consulta correctamente firmada que contiene un registro TKEY. El código afectado solo se puede acceder si una solicitud entrante tiene una firma de transacción (TSIG) válida de una clave declarada en la configuración de 'named'.\nEste problema afecta a las versiones de BIND 9 9.20.0 a 9.20.20, 9.21.0 a 9.21.19, y 9.20.9-S1 a 9.20.20-S1.\nLas versiones de BIND 9 9.18.0 a 9.18.46 y 9.18.11-S1 a 9.18.46-S1 NO están afectadas."
    }
  ],
  "lastModified": "2026-06-17T10:43:04.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C0EF5D0-68A6-4E00-985B-523D9B243E49",
              "versionEndExcluding": "9.20.21",
              "versionStartIncluding": "9.20.0"
            },
            {
              "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1DD0950-5CBD-49B2-8007-5E96B3C4FB1B",
              "versionEndExcluding": "9.21.20",
              "versionStartIncluding": "9.21.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-officer@isc.org"
}