{
  "cvss": 7.5,
  "datePublished": "2026-07-22T15:16:52.080",
  "dateUpdated": "2026-11-02T17:49:56.387",
  "description": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
  "id": "CVE-2026-13204",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "BIND 9",
            "vendor": "ISC",
            "versions": [
              {
                "lessThanOrEqual": "9.18.50",
                "status": "affected",
                "version": "9.11.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24",
                "status": "affected",
                "version": "9.20.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.21.23",
                "status": "affected",
                "version": "9.21.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.18.50-S1",
                "status": "affected",
                "version": "9.11.3-S1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24-S1",
                "status": "affected",
                "version": "9.20.9-S1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security-officer@isc.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0BD9C8C0-B51C-4826-9A67-560E5B3F1C24",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.11.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "22CF447E-BD05-4B2D-B570-7C138D2C2A7C",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.11.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "080D7F98-9784-4586-8ADA-CAAA0A9EC180",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "AA853047-029C-4BC6-9C8C-10B183B9FB9E",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "769711AE-516A-4D05-997D-55E3DEF5697B",
                "versionEndIncluding": "9.21.23",
                "versionStartIncluding": "9.21.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."
      },
      {
        "lang": "es",
        "value": "Si un dominio demostrablemente inseguro está cubierto por un registro NSEC y NSEC3 en el padre, y existe un RRSIG para solo uno de estos tipos, entonces BIND puede cerrarse inesperadamente con una aserción mientras valida esta prueba.\nEste problema afecta a las versiones de BIND 9 9.11.0 hasta 9.18.50, 9.20.0 hasta 9.20.24, 9.21.0 hasta 9.21.23, 9.11.3-S1 hasta 9.18.50-S1, y 9.20.9-S1 hasta 9.20.24-S1."
      }
    ],
    "id": "CVE-2026-13204",
    "lastModified": "2026-11-02T17:49:56.387",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-officer@isc.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-13204",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-22T18:51:59.528740Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-22T15:16:52.080",
    "references": [
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.20.26"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.21.24"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://kb.isc.org/docs/cve-2026-13204"
      }
    ],
    "sourceIdentifier": "security-officer@isc.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-617"
          }
        ],
        "source": "security-officer@isc.org",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for..."
}