CVE-2026-10822
Received Received - Intake

Memory Corruption in BIND Due to Invalid DNS Record

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Internet Systems Consortium (ISC)

Description
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-10822
EUVD
EUVD-2026-47705

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
isc bind From 9.18.0 (inc) to 9.18.50 (inc)
isc bind From 9.20.0 (inc) to 9.20.24 (inc)
isc bind From 9.21.0 (inc) to 9.21.23 (inc)
isc bind From 9.18.11-S1 (inc) to 9.18.50-S1 (inc)
isc bind From 9.20.9-S1 (inc) to 9.20.24-S1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-10822 is a flaw in BIND 9 DNS software where a malformed DNS record with an invalid algorithm identifier can cause BIND to crash. The issue occurs when a key record uses the PRIVATEDNS algorithm (253) with an incorrectly long identifier. BIND stores this invalid data and later fails during text rendering due to the incorrect length, leading to an unexpected abort.

Detection Guidance

Monitor BIND logs for crashes or unexpected exits during DNS record processing. Check for records using PRIVATEDNS algorithm (253) with malformed identifiers. Use 'named-checkconf' to validate configurations and 'dig' to inspect DNSKEY records for anomalies.

Impact Analysis

This vulnerability can cause BIND to crash unexpectedly, disrupting DNS services. If exploited, it may lead to service outages, degraded performance, or loss of DNS resolution for affected systems. The impact depends on whether BIND is used in a critical infrastructure role.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it pertains to DNS record processing failures in BIND. However, if BIND crashes due to this issue, it could disrupt DNS services, potentially leading to service unavailability or data processing interruptions that may indirectly affect compliance with availability requirements in regulations like GDPR or HIPAA.

Mitigation Strategies

Upgrade BIND to patched versions: 9.20.26, 9.21.24, or their Supported Preview Editions. If upgrading is not immediately possible, restrict access to BIND servers and monitor for crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10822. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart