CVE-2026-3591CWE-305CWE-562

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Medium · published March 25, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure.

This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.

BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 29.1th percentile
Weaknesses
CWE-305 · Authentication Bypass by Primary Weakness; CWE-562 · Return of Stack Variable Address
Published
2026-03-25T13:34Z
EPSS history
Timeline
  • 25 MAR 13:34Z
    A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass
    cvelistv5