CVE-2026-13204
Received Received - Intake

Denial of Service in BIND DNS Server

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Internet Systems Consortium (ISC)

Description
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13204
EUVD
EUVD-2026-47712

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
isc bind From 9.11.0 (inc) to 9.18.50 (inc)
isc bind From 9.20.0 (inc) to 9.20.24 (inc)
isc bind From 9.21.0 (inc) to 9.21.23 (inc)
isc bind From 9.11.3-s1 (inc) to 9.18.50-s1 (inc)
isc bind From 9.20.9-s1 (inc) to 9.20.24-s1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in BIND 9 causes an unexpected exit (denial of service) when validating DNSSEC proofs. It occurs if a domain covered by both NSEC and NSEC3 records at the parent level has an RRSIG signature for only one record type. BIND crashes with an assertion failure during validation.

Detection Guidance

Check BIND version with 'named -v' or 'rndc -v'. Monitor logs for assertion failures during DNSSEC validation. Use 'dig +dnssec' to inspect NSEC/NSEC3 records and RRSIG signatures for inconsistencies.

Impact Analysis

This vulnerability can cause BIND to crash, leading to a denial of service for DNS resolution. It may disrupt network services relying on BIND, especially DNS servers. The impact is remote and requires no user interaction.

Compliance Impact

This vulnerability causes BIND to crash unexpectedly during DNSSEC validation, leading to a denial of service. Such disruptions could impact systems handling sensitive data, potentially violating availability requirements in GDPR and HIPAA. However, the provided context does not specify direct compliance impacts.

Mitigation Strategies

Upgrade BIND to version 9.20.26, 9.21.24, or Supported Preview Edition equivalents immediately. Restart named service after upgrade. Ensure DNSSEC validation is enabled to prevent crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart