CVE-2026-3591: 
NixOS vulnerability analysis and mitigation

CVE-2026-3591 is a use-after-return vulnerability in ISC BIND 9's named server that can allow an attacker to bypass IP-based Access Control Lists (ACLs) by sending specially crafted DNS queries signed with SIG(0). The flaw affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1; BIND 9.18.x branches are explicitly not affected. It was disclosed on March 25, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (ISC KB, Red Hat).

The root cause is a use-after-return memory flaw (CWE-562: Return of Stack Variable Address; CWE-825: Expired Pointer Dereference) in the SIG(0) DNS query handling code within the named daemon. When processing a SIG(0)-signed DNS request, a stack variable's address is referenced after the function that allocated it has returned, resulting in stale/invalid memory being used during ACL evaluation. This causes the ACL logic to improperly match or mismatch an IP address, classified as CWE-305 (Authentication Bypass by Primary Weakness). Exploitation requires low privileges (an authenticated network-level attacker capable of sending crafted DNS queries) and no user interaction (ISC KB, Red Hat Bugzilla).

Successful exploitation allows an attacker to cause ACL mismatches in BIND's named server, potentially granting unauthorized access to DNS services that should be restricted by IP-based ACLs. The impact is most severe in environments using default-allow ACLs (which deny only specific IPs), where an attacker could bypass the deny rules and gain access; default-deny ACLs are expected to fail-secure and are less affected. The confidentiality and integrity impacts are both rated low, with no availability impact, as the vulnerability enables unauthorized DNS service access rather than data exfiltration or server crash (ISC KB, Red Hat).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (ISC KB). The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-level network access and the ability to send SIG(0)-signed DNS queries, limiting the attacker pool somewhat.

1. Reconnaissance: Identify target BIND 9 servers running affected versions (9.20.0–9.20.20, 9.21.0–9.21.19, or 9.20.9-S1–9.20.20-S1) using DNS version queries (dig CHAOS TXT version.bind @<target>) or banner-grabbing tools.
2. Assess ACL configuration: Determine whether the target uses a default-allow ACL (i.e., an ACL that permits all traffic except specific denied IPs), which is the configuration most vulnerable to exploitation.
3. Craft SIG(0)-signed DNS query: Construct a specially crafted DNS query signed with SIG(0) designed to trigger the use-after-return condition in the named server's ACL evaluation code.
4. Send the malicious query: Transmit the crafted query to the target named server from a network location that would normally be denied by the ACL.
5. ACL bypass achieved: Due to the stale stack variable being used in IP address matching, the ACL may incorrectly match the attacker's IP as an allowed address, granting unauthorized access to the DNS service (ISC KB, Red Hat Bugzilla).

• Network: Unexpected DNS queries signed with SIG(0) originating from IP addresses that should be blocked by ACL rules; DNS responses served to clients from IP ranges listed in deny ACL entries.
• Logs: BIND named query logs showing successful query responses to IP addresses that are configured in deny-list ACLs; anomalous SIG(0)-signed query patterns in named query logs.
• Process: Unexpected DNS resolution activity or zone transfer responses to unauthorized clients as observed in named statistics or query logs.

Upgrade BIND 9 to version 9.20.21 or later (for the 9.20.x branch), 9.21.20 or later (for the 9.21.x branch), or 9.20.21-S1 or later (for the Subscription Edition). BIND 9.18.x users are not affected and do not need to take action. As a configuration-level mitigation, review and audit all ACL configurations — particularly those using default-allow rules — and consider converting to default-deny ACLs where operationally feasible, as these fail-secure against this vulnerability. Additionally, implement network-level controls (e.g., firewall rules) to restrict which IP addresses can send DNS queries to the named server (ISC KB, ISC Downloads 9.20.21, ISC Downloads 9.21.20).

The vulnerability received coverage from multiple security news outlets including GBHackers and CyberPress, which reported on BIND 9 security flaws allowing attackers to bypass security controls (GBHackers, CyberPress). The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-280) covering the ISC BIND vulnerabilities (CCCS Advisory). Ubuntu issued security notice USN-8124-1 and Debian, openSUSE, and Fedora all released updated packages addressing the flaw. The Hacker News included it in a weekly security recap, and community discussion on platforms like Bluesky noted the ACL bypass nature of the vulnerability.