ISC BIND 9: Nine DNSSEC and Response Handling Flaws Disclosed Together
ISC disclosed nine BIND 9 vulnerabilities on July 23, 2026, related to DNSSEC validation and response processing, posing risks of forgery, DoS, and cache poisoning.
Key findings
- Nine BIND 9 vulnerabilities disclosed on July 23, 2026, impacting DNSSEC validation and response handling.
- Several flaws allow for DNS response forgery and cache poisoning through malformed NSEC/NSEC3 records.
- Vulnerabilities include resource exhaustion and unexpected program termination during DNSSEC validation.
- Attackers may bypass Response Policy Zones (RPZ) and cause denial-of-service conditions.
- Affected versions span multiple BIND 9 release branches, requiring prompt patching.
On July 23, 2026, ISC disclosed a batch of nine vulnerabilities affecting the BIND 9 DNS server software. These vulnerabilities, primarily related to DNSSEC validation and response processing, could allow attackers to forge responses, cause denial-of-service conditions, or poison the DNS cache. The disclosures highlight potential weaknesses in how BIND handles malformed or specifically crafted DNS records, particularly within the context of DNS Security Extensions (DNSSEC).
Several vulnerabilities stem from improper handling of NSEC and NSEC3 records. CVE-2026-10723 describes how BIND may accept incorrect child-zone NSEC3 records, enabling the forgery of authenticated NXDOMAIN responses. Similarly, CVE-2026-13321 points out that the resolver accepts NSEC records where the "Next Domain Name" field points outside the signer's zone, potentially leading to validation issues. CVE-2026-13204 details a scenario where a domain covered by both NSEC and NSEC3 records, with an RRSIG for only one type, can cause BIND to exit unexpectedly during validation.
Resource exhaustion and unexpected program termination are also key themes. CVE-2026-11605 describes a resource exhaustion vulnerability during DNSSEC validation, where BIND expends excessive CPU resources validating superfluous RRSIG records. CVE-2026-11622 details a similar memory exhaustion issue under a random subdomain attack against a DNSSEC-signed zone, where memory usage can increase dramatically. CVE-2026-10822 and CVE-2026-13204 both mention unexpected program termination due to specific invalid data structures or assertion failures during validation. CVE-2026-12617 also notes unexpected program termination related to the ordering and content of responses for CNAME, DNAME, and A records.
Exploitation of these vulnerabilities could lead to significant security breaches. CVE-2026-11331 explains how an attacker can bypass Response Policy Zones (RPZ) by triggering a NAMETOOLONG error, potentially defeating security policies. Furthermore, CVE-2026-11721 details a cache poisoning vulnerability where an attacker's zone can respond with an RRSIG that has fewer labels than the zone itself, allowing the creation of a wildcard name shorter than the attacker's zone.
The affected versions span multiple release branches of BIND 9, including 9.11.x, 9.18.x, 9.20.x, and 9.21.x, with specific patches noted for the extended support (S) releases. Users are advised to consult the official ISC advisories for precise version information and upgrade paths. Addressing these vulnerabilities is crucial for maintaining the integrity and security of DNS infrastructure reliant on BIND.
The timely disclosure of these nine vulnerabilities underscores the ongoing efforts to secure the DNS ecosystem. Users of BIND 9 should prioritize applying patches and reviewing their configurations, especially those utilizing DNSSEC and RPZ features, to mitigate the risks associated with response forgery, denial-of-service, and cache poisoning. Continued vigilance and prompt updates are essential for protecting against these types of threats.