CVE-2026-11721
Received Received - Intake

DNSSEC Cache Poisoning in BIND 9

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Internet Systems Consortium (ISC)

Description
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-11721
EUVD
EUVD-2026-47709

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
isc bind From 9.11.0 (inc) to 9.18.50 (inc)
isc bind From 9.20.0 (inc) to 9.20.24 (inc)
isc bind From 9.21.0 (inc) to 9.21.23 (inc)
isc bind From 9.11.3-S1 (inc) to 9.18.50-S1 (inc)
isc bind From 9.20.9-S1 (inc) to 9.20.24-S1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to perform cache poisoning on a DNS resolver. It occurs when an attacker's zone responds to a query with a malformed RRSIG (Resource Record Signature) that has fewer labels than the zone itself. This causes the resolver to generate a wildcard name shorter than the attacker's zone, enabling cache poisoning if the resolver has the default setting 'synth-from-dnssec yes' enabled.

Detection Guidance

To detect this vulnerability, check if your BIND 9 resolver has the default setting 'synth-from-dnssec yes;' enabled. Inspect your named.conf file for this configuration. Additionally, verify your BIND version against affected versions (9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and their Supported Preview Editions).

Commands to check BIND version: named -v or rpm -qa | grep bind or dpkg -l | grep bind9. For configuration inspection: cat /etc/bind/named.conf or named-checkconf to validate syntax.

Impact Analysis

An attacker could exploit this to redirect users to malicious websites by poisoning the DNS cache. This could lead to phishing attacks, data theft, or unauthorized access to systems. The impact is significant as it affects DNS resolution, which is critical for internet communication.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected BIND versions must address this to maintain regulatory compliance.

Mitigation Strategies

Immediately upgrade to a patched BIND 9 version: 9.20.26, 9.21.24, or their Supported Preview Edition updates (9.20.26-S1). Disable the 'synth-from-dnssec yes;' setting if not required, though this may impact DNSSEC validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart