CVE-2026-13204CWE-617

Unexpected exit in certain situations with NSEC and NSEC3 both present

High · published July 22, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.

This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-07-22T14:15Z
EPSS history
Timeline
  • 22 JUL 14:15Z
    Unexpected exit in certain situations with NSEC and NSEC3 both present
    cvelistv5