ISC BIND 9 CVE-2026-13204

Exploitation requires the target BIND instance to be operating as a validating resolver (DNSSEC validation enabled - the default in modern BIND), and the attacker must control a zone whose parent presents an insecure (unsigned) delegation covered by BOTH an NSEC and an NSEC3 record while providing an RRSIG for only one of those two types; the resolver must then be induced to resolve a name under that zone. Limiting factors: if DNSSEC validation is disabled the code path is unreachable; recursion must be permitted to the attacker (open or reachable resolver, or a client the attacker can drive to trigger the lookup); and the specific NSEC/NSEC3-with-partial-RRSIG combination must be crafted at the parent, which is not a condition that occurs in normal, correctly-signed zones. No credentials or user authentication are needed (PR:N), and no victim user interaction with the daemon itself is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact reachable over the network without authentication or user interaction - a classic remote DoS profile with no confidentiality or integrity exposure. There is no EPSS score, no CISA KEV listing, and no public POC provided, so all exploitation signals point to theoretical rather than observed abuse at this time. The practical severity hinges on one precondition the raw score understates: the target must be performing DNSSEC validation, and the attacker must be able to induce the resolver to look up a domain under their control whose parent zone is crafted with the mismatched NSEC/NSEC3 + partial RRSIG condition. This is straightforward for any attacker who can register or delegate a zone, which keeps AC:L defensible. Because a single crafted response can terminate named and BIND is a core internet resolver, this is a genuine operational priority for anyone running validating recursive resolvers, even absent in-the-wild activity - the impact is service outage, not data loss.

An attacker registers or controls a DNS zone and crafts its parent-side denial-of-existence records so an insecure delegation is covered by both an NSEC and an NSEC3 record while supplying an RRSIG for only one type. They then cause a victim's validating BIND resolver to query a name in that zone - for example by embedding a link, sending an email, or triggering any client-side lookup. When BIND validates the malformed insecurity proof it hits the assertion and named crashes, denying DNS service; no public POC has been identified, but the low attack complexity means reliable reproduction is plausible for a knowledgeable attacker.