CVE-2026-11721
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).
Risk Assessment
The risk is DNS cache poisoning, which could redirect traffic to malicious servers, leading to data theft or phishing.
Recommendation
Upgrade BIND 9 to versions 9.18.51, 9.20.25, 9.21.24, or corresponding S1 versions that fix this vulnerability.
Other vulnerabilities in BIND 9
See all- CVE-2025-13878High
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This vulnerability affects specific versions of BIND 9.
- CVE-1999-0024Medium
CVE-1999-0024 vulnerability involves a malicious attack on DNS cache via BIND, exploiting predictable query IDs.
- CVE-2026-13321High
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.
- CVE-2026-13204High
BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.
- CVE-2026-12617High
BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.
- CVE-2026-11622High
A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.
- CVE-2026-11605High
Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.
- CVE-2026-11331High
BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.
- CVE-2026-10822Medium
A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.
- CVE-2026-10723Medium
BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.
Original NVD description (English source)
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.