CVE-2026-13204 | If a provably insecure domain is covered by both an NSEC and… | CVSS 7.5 HIGH

Description

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Metadata

CVE ID: CVE-2026-13204
State: PUBLISHED
Assigner: isc
Reserved: 2026-06-24 14:12 UTC
Published: 2026-07-22 14:15 UTC
Last updated: 2026-07-22 14:15 UTC
Primary CWE: CWE-617
CWE-617 Reachable Assertion
Vendor / Product: ISC / BIND 9
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
ISC	BIND 9	—	9.11.0 ≤ 9.18.50, 9.20.0 ≤ 9.20.24, 9.21.0 ≤ 9.21.23, 9.11.3-S1 ≤ 9.18.50-S1 …

Weakness (CWE)

CWE	Source	Description
CWE-617	cna	CWE-617 Reachable Assertion

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)