CVE-2026-19033

For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

• CWE-349

• https://downloads.isc.org/isc/bind9/9.20.29
• https://downloads.isc.org/isc/bind9/9.21.26
• https://kb.isc.org/docs/cve-2026-19033

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19025H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does…6.8
• CVE-2026-19026H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 derefere…6.8
• CVE-2026-19027The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_…6.9
• CVE-2026-19028H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.…6.8
• CVE-2026-1903The Ravelry Designs Widget plugin for WordPress is vulnerabl…6.4
• CVE-2026-19032jackson-databind's deserializer for java.nio.file.Path resol…5.3
• CVE-2026-19034A vulnerability was determined in Shibby Tomato 1.28.0000. A…7.3
• CVE-2026-19035A vulnerability was identified in Shibby Tomato 1.28.0000. A…7.3
• CVE-2026-19036A security flaw has been discovered in Shibby Tomato 1.28.00…7.3
• CVE-2026-19037A weakness has been identified in WonderTrader up to 0.9.9. …4.3
• CVE-2026-19038A security vulnerability has been detected in MonomythDevelo…6.3
• CVE-2026-19039A vulnerability was detected in Kino-Kafkaesque ssh-mcp-serv…5.3