A use‑after‑return flaw exists in the named DNS server when processing SIG(0) signed queries. By sending a specially crafted DNS request, an attacker can cause the server to mis‑match an IP address against an ACL. In configurations that allow all traffic except for explicitly denied addresses, this flaw could let the attacker bypass access controls and gain unauthorized access.

The vulnerability impacts ISC BIND 9 DNS server versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and the 9.20.9‑S1 through 9.20.20‑S1 releases. Versions 9.18.0–9.18.46 and 9.18.11‑S1–9.18.46‑S1 are not affected.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The flaw can be triggered by any remote DNS query that reaches the vulnerable server, which an attacker can generate from any network with access to the server. Successful exploitation would result in ACL mis‑matching, allowing traffic that should be denied, potentially enabling unauthorized access to services behind the DNS server. The risk is present in deployments that rely on default‑allow ACLs and does not require local compromise of the system.