ISC BIND 9 CVE-2026-11721

The target must be a BIND 9 recursive resolver with synth-from-dnssec yes; configured - which is the default, so most default deployments are exposed. The attacker must control an authoritative DNS zone and be able to cause the victim resolver to send a query into that zone, then return a crafted response containing an RRSIG whose label count is smaller than the number of labels in the containing zone. Limiting factors: authoritative-only BIND servers are not affected; resolvers that have explicitly set synth-from-dnssec no; are not exploitable; and the attacker needs the victim to actually resolve a name under the attacker's zone for the poisoned wildcard synthesis to occur.

The NVD/ISC CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) is internally consistent with the description: exploitation is remote and unauthenticated in the sense that the attacker only needs to operate their own authoritative zone and induce the victim resolver to query it - no credentials on the target. Impact is integrity-only (cache poisoning), with no confidentiality or availability loss, which matches the C:N/I:H/A:N profile. The one nuance worth flagging is attack complexity: the description notes the target resolver must have synth-from-dnssec yes;, but since that is the default, treating this as AC:L is defensible rather than AC:H. There is no CISA KEV listing and no EPSS score, SSVC decision, or POC provided in the input, so exploitation probability cannot be quantified from the data given; this reads as a credible, patch-worthy integrity flaw rather than a confirmed mass-exploitation event. Cache poisoning against a shared recursive resolver has high blast radius (all downstream clients), so despite integrity-only scope this warrants prompt patching, especially for ISPs and enterprises running BIND as their recursive resolver.

An attacker registers or controls an authoritative zone and lures or waits for a target BIND recursive resolver to query a name in that zone (e.g., by embedding a hostname in an email or web resource). The malicious authoritative server answers with an RRSIG whose label count is smaller than the zone's own label count, causing named to synthesize and cache a wildcard record for a shorter, higher-level namespace the attacker does not own, poisoning the resolver's cache for other clients. No public exploit code is identified at time of analysis, but the low attack complexity and network vector make weaponization plausible.