SB2026072347 - Multiple vulnerabilities in ISC BIND
Published: July 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-13321)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to poison the DNS cache and cause authenticated denial-of-service responses.
The vulnerability exists due to improper input validation in DNSSEC NSEC record validation when processing validly signed NSEC records whose next domain name points outside the signer's zone. A remote attacker can craft malicious NSEC records to poison the DNS cache and cause authenticated denial-of-service responses.
Exploitation requires control of any DNSSEC-signed zone.
2) Reachable assertion (CVE-ID: CVE-2026-13204)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion failure in the DNSSEC validation logic when validating a provably insecure domain covered by both an NSEC and NSEC3 record at the parent with an RRSIG for only one of these types. A remote attacker can provide crafted DNS data to cause a denial of service.
3) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-12617)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of record ordering and response content in named resolver processing when processing responses to queries for CNAME or DNAME and A records. A remote attacker can send specially crafted DNS responses to cause a denial of service.
The issue is triggered when an authoritative server returns responses in a specific order, including delayed negative DNAME replies or a delayed self-referential CNAME reply.
4) Input validation error (CVE-ID: CVE-2026-11721)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to improper input validation in named when processing DNS responses containing an RRSIG with fewer labels than the containing zone and wildcard records. A remote attacker can operate an authoritative zone that returns a specially crafted response to poison the DNS cache.
The issue has effect only when the resolver under attack has synth-from-dnssec yes; enabled, which is the default.
5) Resource exhaustion (CVE-ID: CVE-2026-11622)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the DNSSEC validating resolver when processing queries during a random subdomain attack against a DNSSEC-signed zone. A remote attacker can send queries faster than the resolver can perform validation to cause a denial of service.
Only DNSSEC validating resolvers targeted with a random subdomain attack against a DNSSEC-signed zone are affected.
6) Resource exhaustion (CVE-ID: CVE-2026-11605)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to resource exhaustion in DNSSEC validation when processing answers containing many valid but superfluous RRSIG records. A remote attacker can send a query that triggers validation of such records to cause a denial of service.
The issue results in disproportionate CPU consumption during validation.
7) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-11331)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass RPZ rules.
The vulnerability exists due to improper error handling in RPZ processing when processing sufficiently long query names that trigger a NAMETOOLONG condition with wildcard CNAME policies. A remote attacker can send a crafted query name to bypass RPZ rules.
The issue only affects resolvers that use RPZ with wildcard CNAME policies.
8) Input validation error (CVE-ID: CVE-2026-10822)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in DNS record text rendering when processing a stored DNS record with a PRIVATEDNS algorithm identifier length longer than the actual identifier data. A remote attacker can supply a specially crafted DNS record to cause a denial of service.
User interaction is required for BIND to later render the stored record to text.
9) Input validation error (CVE-ID: CVE-2026-10723)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to forge authenticated NXDOMAIN responses.
The vulnerability exists due to improper validation of child-zone NSEC3 records in BIND 9 when processing DNSSEC records. A remote attacker can provide incorrect child-zone NSEC3 records to forge authenticated NXDOMAIN responses.
The issue can affect sibling zones.
Remediation
Install update from vendor's website.
References
- https://kb.isc.org/docs/cve-2026-13321-dnssec-validation-bypass-via-out-of-zone-nsec-next-field
- https://kb.isc.org/docs/cve-2026-13321
- https://kb.isc.org/docs/cve-2026-13204-unexpected-exit-certain-situations-nsec-nsec3
- https://kb.isc.org/docs/cve-2026-13204
- https://kb.isc.org/docs/cve-2026-12617-record-ordering-based-unexpected-exit-with-cname-or-dname
- https://kb.isc.org/docs/cve-2026-12617
- https://kb.isc.org/docs/cve-2026-11721-cache-poisoning-label-count-discrepancy-rrsig-wildcards
- https://kb.isc.org/docs/cve-2026-11721
- https://kb.isc.org/docs/cve-2026-11622-potential-memory-usage-beyond-configured-limits
- https://kb.isc.org/docs/cve-2026-11622
- https://kb.isc.org/docs/cve-2026-11605-unnecessary-validation-of-dnssec-signed-records
- https://kb.isc.org/docs/cve-2026-11605
- https://kb.isc.org/docs/cve-2026-11331-potential-wildcard-cname-rpz-policy-bypass
- https://kb.isc.org/docs/cve-2026-11331
- https://kb.isc.org/docs/cve-2026-10822-key-record-using-privatedns-algorithm-may-lead-to-unexpected-exit
- https://kb.isc.org/docs/cve-2026-10822
- https://kb.isc.org/docs/cve-2026-10723-incorrect-acceptance-of-nsec3-records
- https://kb.isc.org/docs/cve-2026-10723