Skip to content
Threat Feed
Subscribe
low advisory

CVE-2026-13204: BIND 9 Denial-of-Service Vulnerability

A critical vulnerability (CVE-2026-13204) in Internet Systems Consortium (ISC) BIND 9 can lead to a denial-of-service condition where the server exits unexpectedly due to an assertion failure during DNSSEC validation of specific NSEC/NSEC3 record configurations. This allows an unauthenticated attacker to cause a BIND 9 DNS resolver to crash, disrupting DNS resolution services.

A high-severity denial-of-service vulnerability, identified as CVE-2026-13204, has been discovered in multiple versions of Internet Systems Consortium (ISC) BIND 9. This flaw exists in the DNSSEC validation logic. Specifically, if a DNS resolver running a vulnerable BIND 9 version attempts to validate a provably insecure domain where the parent zone provides both NSEC (Next Secure) and NSEC3 (NSEC version 3) records, but an RRSIG (Resource Record Signature) exists for only one of these types, the BIND process may terminate unexpectedly. This assertion failure effectively causes a denial of service for the affected BIND server, disrupting DNS resolution for its clients. The vulnerability affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and specific extended support versions.

Attack Chain

  1. An attacker controls an authoritative DNS server for a malicious domain.
  2. The attacker configures their authoritative server to serve the parent zone of the malicious domain with both NSEC and NSEC3 records.
  3. The attacker deliberately ensures that an RRSIG (DNSSEC signature) is present for only one of these record types (either NSEC or NSEC3), but not both, for the malicious domain's non-existent records.
  4. A vulnerable BIND 9 DNS resolver attempts to validate a query for a non-existent record within this malicious domain.
  5. During DNSSEC validation, the BIND resolver attempts to process the insecure domain's NSEC and NSEC3 records and their RRSIGs as provided by the attacker-controlled authoritative server.
  6. Due to the specific and malformed configuration (presence of both NSEC/NSEC3 records with an RRSIG for only one), the BIND resolver encounters an assertion failure within its validation logic.
  7. The BIND 9 server process exits unexpectedly, leading to a denial of service for all DNS resolution requests that it handles.

Impact

Successful exploitation of CVE-2026-13204 leads to a complete denial of service for the affected BIND 9 DNS resolver. This can prevent users and systems reliant on the compromised resolver from accessing internet resources, causing significant operational disruption. With a CVSS v3.1 Base Score of 7.5 (High), this vulnerability poses a severe risk to organizations running vulnerable BIND 9 instances. The impact is network-wide, as DNS is a fundamental service for internet communication. Any organization utilizing affected BIND 9 versions for their DNS infrastructure is at risk.

Recommendation

  • Prioritize patching all affected BIND 9 instances to a fixed version as soon as possible, referencing the security advisories linked in this brief. Specific versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1 are affected.
  • Monitor BIND 9 server logs for unexpected process terminations or assertion failures, which may indicate attempted exploitation of CVE-2026-13204.
  • Ensure robust monitoring and alerting for DNS service availability to quickly detect and respond to potential denial-of-service events on BIND 9 servers.