Skip to main content

ISC BIND 9 CVE-2026-11721

| EUVDEUVD-2026-47709 HIGH
Improper Validation of Specified Quantity in Input (CWE-1284)
2026-07-22 isc GHSA-cq66-h8mj-77hh
Information Disclosure Bind 9 Red Hat Suse
7.5
CVSS 3.1 · Vendor: isc
Share

Severity by source

Vendor (isc) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
7.5 HIGH

Remote unauthenticated attacker with only their own zone (PR:N, AV:N); default-enabled feature keeps AC:L; cache poisoning gives integrity-only impact (I:H, C/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 15:18 vuln.today
CVE Published
Jul 22, 2026 - 14:13 cve.org
HIGH 7.5

DescriptionCVE.org

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

AnalysisAI

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged records by returning an RRSIG with fewer labels than its containing zone, tricking named into synthesizing a wildcard name for a zone shorter than the attacker's own. Affected versions span the 9.11.x through 9.21.x branches (including -S subscription editions), and the flaw is exploitable against default deployments because the triggering feature synth-from-dnssec is enabled by default. No public exploit identified at time of analysis; the issue was reported by ISC and vendor patches (9.20.26, 9.21.24) are available.

Technical ContextAI

BIND 9 is the reference DNS server implementation from the Internet Systems Consortium, widely used for both authoritative and recursive (caching) name service. The defect lives in BIND's aggressive DNSSEC negative-answer synthesis feature, controlled by synth-from-dnssec, which lets a validating resolver synthesize NXDOMAIN/wildcard responses from cached NSEC/NSEC3 records rather than re-querying. The root cause is CWE-1284 (Improper Validation of Specified Quantity in Input): named fails to validate that the label count in an RRSIG is not smaller than the number of labels in the zone that contains it. An RRSIG's 'labels' field is supposed to bound how far a wildcard may expand; by advertising a label count smaller than the zone apex, an attacker's authoritative zone causes named to derive a synthesized wildcard name belonging to a parent/shorter namespace outside the attacker's control, which then gets cached. Per the CPE (cpe:2.3:a:isc:bind_9), only the BIND 9 code base is implicated.

RemediationAI

Vendor-released patch: upgrade to BIND 9.20.26 (stable branch) or 9.21.24 (development branch), available from https://downloads.isc.org/isc/bind9/9.20.26 and https://downloads.isc.org/isc/bind9/9.21.24, with details in the ISC advisory at https://kb.isc.org/docs/cve-2026-11721; the older 9.11.x and 9.18.x branches are end-of-life or covered under subscription support, so confirm your -S edition upgrade path with ISC. As a temporary workaround where immediate patching is not possible, set synth-from-dnssec no; in the resolver configuration to disable the aggressive DNSSEC synthesis feature that the attack abuses - the trade-off is a loss of the performance and privacy benefit of synthesized negative answers (more upstream queries and slower NXDOMAIN handling), but it removes the attack surface entirely. Restricting recursion to trusted clients (allow-recursion) limits who can steer the resolver toward attacker-controlled zones but does not fully close the issue, since any permitted client query for an attacker domain can trigger it.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-11622 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
CVE-2026-3039 HIGH
7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
CVE-2026-5946 HIGH
7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
CVE-2026-10723 MEDIUM
6.8 Jul 22

DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all
CVE-2025-9316 MEDIUM POC
6.9
CVE-2026-49777 CRITICAL POC
10.0
CVE-2022-37134 CRITICAL POC
9.8
CVE-2021-43267 CRITICAL POC
9.8
CVE-2025-65548 CRITICAL POC
9.1
CVE-2023-54337 CRITICAL POC
9.1
CVE-2025-5349 HIGH POC
8.8
CVE-2026-55706 HIGH POC
8.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-11721 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy