CVE-2026-19033

A flaw was found in bind. A remote attacker without a valid TSIG Transaction Signature can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR Incremental Zone Transfer. The named process may apply this unauthenticated data before the TSIG signature is verified. ...

EUVD-2026-80781

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to ...