Login Request a demo
High severity · published Jul 22, 2026
CVE-2026-13204
Unexpected exit in certain situations with NSEC and NSEC3 both present
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
B9
BIND 9 · ISC
9.11.0 through 9.18.50; 9.20.0 through 9.20.24; 9.21.0 through 9.21.23; 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.24-S1 · source: vendor
Affected product
B9
BIND 9
ISC
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13204
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13204
downloads.isc.org
https://downloads.isc.org/isc/bind9/9.20.26
downloads.isc.org
https://downloads.isc.org/isc/bind9/9.21.24
kb.isc.org
https://kb.isc.org/docs/cve-2026-13204
More from BIND 9
9.8
CVE-2026-3593
Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation
8.6
CVE-2026-13321
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
8.1
CVE-2026-94300
Concurrent GSS-TSIG messages corrupt memory
7.8
CVE-2017-3141
Windows service and uninstall paths are not quoted when BIND is installed
7.5
CVE-2026-97313
Specific RPZ configurations and query patterns may result in an unexpected exit