Skip to content
Threat Feed
Subscribe
high advisory

CVE-2026-13321 BIND Resolver Origin Validation Error

CVE-2026-13321 describes a vulnerability in the BIND resolver where it incorrectly accepts validly-signed NSEC records that contain a 'Next Domain Name' field pointing outside the signer's zone, impacting integrity with a CVSSv3.1 score of 8.6 and requiring immediate updates to affected BIND 9 installations.

CVE-2026-13321, identified by the Internet Systems Consortium (ISC), details an origin validation error (CWE-346) in the BIND 9 DNS resolver. This vulnerability allows the resolver to accept validly-signed NSEC records even when their "Next Domain Name" field references a domain name outside the signer's designated zone. This critical flaw has a CVSSv3.1 base score of 8.6, indicating a high impact on integrity. The issue affects a wide range of BIND 9 versions, including 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and their corresponding -S1 series. Organizations operating affected BIND resolvers are at risk of DNS cache poisoning or other DNS-based attacks due to improper validation of DNSSEC records. The vulnerability enables an attacker to manipulate DNS resolution, potentially leading to redirection to malicious servers or interception of network traffic.

Impact

Successful exploitation of CVE-2026-13321 could lead to significant integrity compromises within organizations reliant on vulnerable BIND resolvers. The high integrity impact (I:H) indicated by the CVSS score suggests that an attacker could inject malicious or incorrect data into the DNS cache. This cache poisoning could enable DNS spoofing, where users are redirected to attacker-controlled websites instead of legitimate ones. Such redirection can facilitate phishing attacks, credential harvesting, or the delivery of malware. Organizations, regardless of sector, that use affected BIND versions for DNS resolution are vulnerable to these attacks, potentially leading to data breaches, service disruptions, and reputational damage.

Recommendation

  • Immediately update all affected BIND 9 installations to patched versions available from ISC to remediate CVE-2026-13321. Specifically, update BIND 9.18.50 to 9.18.51, 9.20.24 to 9.20.26, and 9.21.23 to 9.21.24 or newer as referenced in the ISC advisory.
  • Regularly monitor DNS query and response logs for anomalies, especially around NSEC records or unexpected domain resolutions, to detect potential exploitation attempts.