ISC BIND 9 CVE-2026-10822

BIND must first ingest and store a DNS KEY or DNSKEY record that (1) specifies the PRIVATEDNS algorithm number 253, and (2) includes an algorithm identifier where the declared length exceeds the actual identifier bytes present. This record must reach BIND through a zone it serves as secondary (requiring the attacker to control the primary zone master or compromise it), through a forwarder or authoritative response received during recursive resolution, or through direct zone data injection if the attacker has write access to zone files. After storage, BIND must subsequently attempt to render the stored record to text - a step that is not automatic upon receipt and requires a secondary trigger such as a zone dump, debug logging, or text-format output operation. The CVSS UI:R metric reflects this two-phase requirement. Exploitation is limited to denial of service; the crash does not yield code execution or data leakage. The vulnerability does not affect BIND configurations that never store DNSKEY or KEY records with private algorithm identifiers, such as pure caching resolvers that do not perform DNSSEC validation on zones using PRIVATEDNS algorithm 253.

The CVSS 6.5 medium score reflects a network-accessible availability-only impact with no confidentiality or integrity consequences, and the UI:R component indicates BIND must take a secondary action (rendering to text) after initial record storage, making single-packet exploitation impossible. Real-world risk is meaningful but conditional: an attacker must control a DNS zone that a BIND instance queries or transfers, or must be positioned to serve crafted authoritative responses to a recursive BIND resolver. The impact is a clean process exit (DoS), not code execution. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The absence of a KEV listing and the absence of public POC code both reduce urgency relative to a pure CVSS reading. However, the exceptionally broad version range affected - spanning 9.18.x, 9.20.x, and 9.21.x across both open-source and subscription builds - means a very large number of unpatched deployments are vulnerable. The crash loop risk (if BIND is configured for automatic restart and the malformed zone data persists) could result in sustained unavailability rather than a one-time outage. The 'Information Disclosure' tag in the input data appears inconsistent with the described impact, which is purely availability; no confidentiality loss is indicated in the description or CVSS vector.

An attacker who operates an authoritative DNS zone - or who can perform DNS spoofing or act as a rogue zone master - serves a DNSKEY or KEY record with the PRIVATEDNS algorithm (253) where the algorithm identifier's declared length exceeds the bytes present. A BIND 9 server configured as a secondary for that zone, or a recursive resolver that queries it, stores the malformed record. The next time BIND attempts to render that stored record to text (such as during a zone dump, a diagnostic query that triggers logging, or a named-checkzone invocation), the internal consistency assertion fires and the named process exits, causing a denial of service for all DNS queries served by that instance.