CVE-2026-19033: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-19033 is a TSIG authentication bypass vulnerability in ISC BIND 9 that allows an unauthenticated remote attacker to inject unauthorized zone contents into a secondary DNS server via multi-message TCP Incremental Zone Transfer (IXFR). The flaw affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and corresponding BIND Supported Preview Edition (S1) releases. It was disclosed on September 16, 2026, with patches available in BIND 9.20.29 and 9.21.26. The CVSS v3.1 base score is 6.5 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is improper verification of cryptographic signatures (CWE-347) combined with acceptance of extraneous untrusted data with trusted data (CWE-349). When a secondary zone is configured to restrict zone transfers using TSIG, named begins applying and serving zone data received during a multi-message TCP IXFR before the final message carrying the TSIG signature is received and validated. If the TSIG-signed final message never arrives — for example, because an attacker terminates the transfer early after injecting malicious data — named fails to roll back to its pre-transfer state, leaving the corrupted zone data in place and actively served. Exploitation requires the ability to initiate or intercept a multi-message TCP IXFR to the target secondary nameserver, as specified by RFC 8945 (Red Hat Bugzilla, ISC KB).

Successful exploitation allows an unauthenticated attacker to corrupt DNS zone data served by secondary nameservers, effectively poisoning DNS responses for all clients relying on those servers. The integrity impact is high — attackers can redirect traffic, intercept communications, or facilitate phishing by substituting malicious DNS records — while availability may be partially degraded if zone data becomes inconsistent. Confidentiality is not directly impacted, but DNS poisoning can enable downstream attacks such as credential harvesting or man-in-the-middle interception (Red Hat Advisory, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, the ability to conduct or intercept a multi-message TCP IXFR to a secondary nameserver — which limits opportunistic exploitation but does not preclude targeted attacks against DNS infrastructure.

1. Reconnaissance: Identify secondary BIND nameservers running affected versions (9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, or S1 equivalents) that are configured to accept TSIG-restricted zone transfers via IXFR.
2. Position for interception or impersonation: Gain a network position capable of initiating or intercepting a TCP IXFR session between a primary and secondary nameserver (e.g., via ARP spoofing, BGP hijacking, or compromising an intermediate network device).
3. Initiate multi-message TCP IXFR: Send or relay a crafted IXFR response to the secondary named instance that spans multiple TCP messages, as defined by RFC 8945, containing malicious zone data (e.g., substituted A/AAAA/MX/NS records).
4. Inject malicious zone data: Deliver the crafted zone delta records across the initial TCP messages so that named begins applying and serving the data before TSIG validation occurs.
5. Abort before TSIG delivery: Terminate the TCP session or withhold the final TSIG-signed message, preventing named from completing signature verification.
6. Observe persistence: Because named does not roll back to the pre-transfer state, the injected zone data remains active and is served to DNS clients, enabling traffic redirection or further attacks (Red Hat Bugzilla, ISC KB).

• Network: Unexpected or incomplete TCP IXFR sessions to secondary nameservers (sessions that terminate without a TSIG-signed final message); IXFR traffic originating from unauthorized IP addresses not matching configured primary nameservers.
• Logs: named log entries showing zone transfer completion without a corresponding TSIG verification success message; log entries indicating zone data was updated from an unexpected source address; absence of TSIG signature validation log entries following a zone transfer event.
• DNS Data: Unexpected changes to zone records on secondary nameservers (e.g., altered A, AAAA, MX, or NS records) that do not match the authoritative primary zone; discrepancies between primary and secondary zone serial numbers or record content.
• Process/State: Secondary named serving zone data that differs from the primary without a corresponding authorized zone transfer completing successfully.

ISC has released patched versions BIND 9.20.29 and 9.21.26, which address this vulnerability; operators should upgrade immediately (Github Advisory, ISC KB). As interim workarounds, implement strict network-level access controls (firewall rules) to restrict IXFR/AXFR requests to only authorized primary nameserver IP addresses, reducing the attack surface even if TSIG is configured. Additionally, monitor zone transfer logs for incomplete or anomalous IXFR sessions and consider disabling IXFR in favor of AXFR where incremental transfers are not strictly required (Red Hat Bugzilla).

The vulnerability was reported across multiple security tracking platforms including Linux Compatible, VulDB, and OSS-Security mailing list shortly after disclosure on September 16, 2026, indicating broad community awareness (Linux Compatible, OSS-Sec). Red Hat promptly opened a security tracking bug and engaged its product security team, reflecting the vulnerability's relevance to enterprise Linux distributions (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking activity.