CVE-2026-78301
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone…
- Risk score
- 42/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 16 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-78301: A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone… (CVSS 5.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8969-1: Bind vulnerabilities
Connects to
- Same weakness: CWE-349 (CWE-349). 7 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 83 in the last 90 days
Why it is Yellow
- CVSS 5.8 medium
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Last activity 3 Nov 2026. Patch Forecast updates every hour.