BIND 9 (9.11.0 Through 9.18.50)

CVE-2026-13321 describes a vulnerability in the BIND resolver where it incorrectly accepts validly-signed NSEC records that contain a 'Next Domain Name' field pointing outside the signer's zone, impacting integrity with a CVSSv3.1 score of 8.6 and requiring immediate updates to affected BIND 9 installations.

A critical vulnerability (CVE-2026-13204) in Internet Systems Consortium (ISC) BIND 9 can lead to a denial-of-service condition where the server exits unexpectedly due to an assertion failure during DNSSEC validation of specific NSEC/NSEC3 record configurations. This allows an unauthenticated attacker to cause a BIND 9 DNS resolver to crash, disrupting DNS resolution services.

A DNSSEC validating resolver, specifically BIND 9 versions within the ranges 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and their S1 variants, is vulnerable to a denial-of-service attack where an attacker can launch a random subdomain attack against a DNSSEC-signed zone by sending queries faster than the resolver can perform validation, leading to runaway memory usage and potentially exceeding configured limits by orders of magnitude.