CVE-2026-3119: isc bind Reachable Assertion
Vulnerability summary
CVE-2026-3119 is a medium (CVSS 6.5) Reachable Assertion vulnerability in isc bind. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 25-03-2026Last modifiedVulnerability information updated.
Description
Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.02 pp
From 0.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- bind9< 1:9.20.11-1ubuntu2.2
- bind9-libsAll versions (No fix recorded)
- isc-dhcpAll versions (No fix recorded)
Isc2 products
Alpine1 product
- bind≥ 9.20.0, < 9.20.21-r0
Debian1 product
- bind9< 1:9.20.21-1~deb13u1 | < 1:9.20.21-1
4 vendors · 7 products
