CVE-2026-78301

A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this by introducing a specially crafted, malformed DNS zone into an authoritative BIND server. This action could cause the server to incorrectly delegate authority for parts of its own configured zones. As a result, if the server also performs recursive lookups, it might cache incorrect information provided by the attacker, leading to DNS cache poisoning and potentially redirecting users to malicious websites or services.

Moderate impact. BIND servers configured for both authoritative and recursive functions are vulnerable to DNS cache poisoning. An attacker who can insert a malformed zone, for example via zone transfer, can cause the server to cache attacker-supplied data for names outside the configured zone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, Red Hat recommends separating authoritative and recursive DNS functions onto different BIND instances or servers. This prevents a compromised authoritative zone from affecting recursive queries. Additionally, restrict zone transfer sources to trusted hosts only by configuring allow-transfer directives within your named.conf zone definitions. After modifying named.conf, the BIND service must be reloaded for changes to take effect, which may temporarily interrupt DNS resolution.