A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 45921d77-b346-11f1-952f-589cfc023192 advisory.

    ISC team reports:
    CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching     CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets     CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path     CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add()     CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver     CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification     CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request     CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees     CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement     CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts     CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof     CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading
    a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions
    9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and
    9.20.9-S1 through 9.20.27-S1. (CVE-2026-77119)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4285-1 advisory.

    - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification     (bsc#1280430).
    - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
    - CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
    - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
    - CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
    - CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof     (bsc#1280437).
    - CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work     amplification       (bsc#1280438).
    - CVE-2026-76163: named aborts on a TKEY query when the user configuration has no global options statement       (bsc#1280439).
    - CVE-2026-77119: NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (bsc#1280440).
    - CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (bsc#1280441).
    - CVE-2026-78301: Out-of-zone database nodes can become authoritative zone cuts (bsc#1280442).
    - CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof (bsc#1280443).
    - CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references (bsc#1280444).
    - CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (bsc#1280445).

    Changes for bind:

    Upgrade to release 9.20.29

     New Features:
     * Disclose active Negative Trust Anchors with Extended DNS Error      33.
     Feature Changes:
     * Reject oversized and malformed DNSKEY records up front.
     * Speed up RPZ policy zone updates.
     Bug Fixes:
     * Prevent a crash when using both dns64 and filter-a.
     * Stop passing UDP client addresses to update-policy external      helpers.
     * Missing required NSEC3 for delegation not detected.
     * Tighten EUI48 and EUI64 text parsing.
     * GeoIP ACL state could be stale or wrong after reload.
     * Honor DNSSEC policy key tag ranges.
     * Fix a double free in mdig when EDNS options are specified.
     * Fix a crash when an IXFR falls back to AXFR with updates still      pending.
     * Fix DS requests to parental agents over TLS.
     * Fix the rndc-confgen -q (quiet) option.
     * Enforce query ACLs for redirect zones and searched DLZs.
     * Check asnum validity in GeoIP ACLs.
     * Fix a crash on remote-servers lists that reference themselves.
     * A record from outside a response policy zone could crash named.
     * Invalid key-store configuration could abort the DNSSEC tools.
     * NSEC signature set could bypass the secure-delegation check.
     * Fix a possible nsupdate issue when using GSS-TSIG.
     * Fix a crash with a single-element geoip sortlist.
     * Prevent out-of-bailiwick CNAMEs from evicting cached records.
     * Restore periodic cleanup of stale resolver address data.
     * Fix named-checkconf/named crash with malformed key name.
     * Prevent resolver crashes while processing DNS over TCP.
     * Ensure NSEC authority does not cross zonecut boundary.
     * Treat an unusable NSEC3 chain as a verification failure.
     * Treat non-canonical RPZ prefixes as any other failure.
     * Negative caching stopped working with      stale-answer-client-timeout set to 0.
     * An unterminated OpenSSL private-key Label: field could be read      past its parser buffer.
     * Restore SMF support on Solaris and illumos.
     * Fix compilation on GNU/Hurd.
     * dig +yaml was producing invalid YAML when a lookup failed.
     * Properly prevent TSIG generation command line injection      attacks.
     * Fix a potential heap bounds overflow write in dnssec-signzone.
     * Fix crashes on invalid DNSTAP input in dnstap-read.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ISC BIND running on the remote host is 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by multiple vulnerabilities :

  - If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server     replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner     name, it will trigger an unexpected program exit. (CVE-2026-80274)

  - A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a     secure delegation and letting a forged unsigned answer through. (CVE-2026-77119)

  - A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an     attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for     names inside the configured zone then lose authoritative status and return an out-of-zone delegation.
    (CVE-2026-78301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6505 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6505-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 17, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : bind9     CVE ID         : CVE-2026-19033 CVE-2026-19662 CVE-2026-19666 CVE-2026-19667                      CVE-2026-19668 CVE-2026-75029 CVE-2026-76163 CVE-2026-77119                      CVE-2026-77692 CVE-2026-80274 CVE-2026-81563 CVE-2026-81736

    Several vulnerabilities were discovered in BIND, a DNS server implementation,     which may result in denial of service or cache poisoning.

    For the stable distribution (trixie), these problems have been fixed in     version 1:9.20.29-1~deb13u1.

    We recommend that you upgrade your bind9 packages.

    For the detailed security status of bind9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bind9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading     a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions     9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and     9.20.9-S1 through 9.20.27-S1. (CVE-2026-77119)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362910	FreeBSD : bind920 -- multiple vulnerabilities (45921d77-b346-11f1-952f-589cfc023192)	Nessus	FreeBSD Local Security Checks	Local	medium
458501	Echo: bind9: security update to 1:9.20.29-1~deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458501	Echo: bind9: security update to 1:9.20.29-1~deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
349183	SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:4285-1)	Nessus	SuSE Local Security Checks	Local	medium
347969	ISC BIND 9.11.0 < 9.20.29 / 9.11.3-S1 < 9.20.29-S1 / 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 Multiple Vulnerabilities	Nessus	DNS	Remote	medium
346980	Debian dsa-6505 : bind9 - security update	Nessus	Debian Local Security Checks	Local	medium
346591	Linux Distros Unpatched Vulnerability : CVE-2026-77119	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-77119

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium