CVE-2026-3591: A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-06-17
Weakness: CWE-305

Description

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Affected products

ISC BIND: from 9.20.0 before 9.20.21; from 9.21.0 before 9.21.20 — fixed in 9.20.21, 9.21.20

How to fix

Upgrade to a fixed version: ISC BIND 9.20.21, 9.21.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-3591 or the next vulnerability affects your stack