{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/bind-9-9.20.0-through-9.20.24/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-13321"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.11.0 through 9.18.50)","BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.21.0 through 9.21.23)","BIND 9 (9.11.3-S1 through 9.18.50-S1)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","dns","bind"],"_cs_type":"advisory","_cs_vendors":["Internet Systems Consortium"],"content_html":"\u003cp\u003eCVE-2026-13321, identified by the Internet Systems Consortium (ISC), details an origin validation error (CWE-346) in the BIND 9 DNS resolver. This vulnerability allows the resolver to accept validly-signed NSEC records even when their \u0026quot;Next Domain Name\u0026quot; field references a domain name outside the signer's designated zone. This critical flaw has a CVSSv3.1 base score of 8.6, indicating a high impact on integrity. The issue affects a wide range of BIND 9 versions, including 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and their corresponding -S1 series. Organizations operating affected BIND resolvers are at risk of DNS cache poisoning or other DNS-based attacks due to improper validation of DNSSEC records. The vulnerability enables an attacker to manipulate DNS resolution, potentially leading to redirection to malicious servers or interception of network traffic.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-13321 could lead to significant integrity compromises within organizations reliant on vulnerable BIND resolvers. The high integrity impact (I:H) indicated by the CVSS score suggests that an attacker could inject malicious or incorrect data into the DNS cache. This cache poisoning could enable DNS spoofing, where users are redirected to attacker-controlled websites instead of legitimate ones. Such redirection can facilitate phishing attacks, credential harvesting, or the delivery of malware. Organizations, regardless of sector, that use affected BIND versions for DNS resolution are vulnerable to these attacks, potentially leading to data breaches, service disruptions, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update all affected BIND 9 installations to patched versions available from ISC to remediate CVE-2026-13321. Specifically, update BIND 9.18.50 to 9.18.51, 9.20.24 to 9.20.26, and 9.21.23 to 9.21.24 or newer as referenced in the ISC advisory.\u003c/li\u003e\n\u003cli\u003eRegularly monitor DNS query and response logs for anomalies, especially around NSEC records or unexpected domain resolutions, to detect potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:24:36Z","date_published":"2026-07-22T15:24:36Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13321-bind-nsec-vulnerability/","summary":"CVE-2026-13321 describes a vulnerability in the BIND resolver where it incorrectly accepts validly-signed NSEC records that contain a 'Next Domain Name' field pointing outside the signer's zone, impacting integrity with a CVSSv3.1 score of 8.6 and requiring immediate updates to affected BIND 9 installations.","title":"CVE-2026-13321 BIND Resolver Origin Validation Error","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13321-bind-nsec-vulnerability/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-13204"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.11.0 through 9.18.50)","BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.21.0 through 9.21.23)","BIND 9 (9.11.3-S1 through 9.18.50-S1)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["low"],"_cs_tags":["dns","dos","vulnerability","bind","cve"],"_cs_type":"advisory","_cs_vendors":["Internet Systems Consortium (ISC)"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, identified as CVE-2026-13204, has been discovered in multiple versions of Internet Systems Consortium (ISC) BIND 9. This flaw exists in the DNSSEC validation logic. Specifically, if a DNS resolver running a vulnerable BIND 9 version attempts to validate a provably insecure domain where the parent zone provides both NSEC (Next Secure) and NSEC3 (NSEC version 3) records, but an RRSIG (Resource Record Signature) exists for only one of these types, the BIND process may terminate unexpectedly. This assertion failure effectively causes a denial of service for the affected BIND server, disrupting DNS resolution for its clients. The vulnerability affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and specific extended support versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker controls an authoritative DNS server for a malicious domain.\u003c/li\u003e\n\u003cli\u003eThe attacker configures their authoritative server to serve the parent zone of the malicious domain with both NSEC and NSEC3 records.\u003c/li\u003e\n\u003cli\u003eThe attacker deliberately ensures that an RRSIG (DNSSEC signature) is present for only one of these record types (either NSEC or NSEC3), but not both, for the malicious domain's non-existent records.\u003c/li\u003e\n\u003cli\u003eA vulnerable BIND 9 DNS resolver attempts to validate a query for a non-existent record within this malicious domain.\u003c/li\u003e\n\u003cli\u003eDuring DNSSEC validation, the BIND resolver attempts to process the insecure domain's NSEC and NSEC3 records and their RRSIGs as provided by the attacker-controlled authoritative server.\u003c/li\u003e\n\u003cli\u003eDue to the specific and malformed configuration (presence of both NSEC/NSEC3 records with an RRSIG for only one), the BIND resolver encounters an assertion failure within its validation logic.\u003c/li\u003e\n\u003cli\u003eThe BIND 9 server process exits unexpectedly, leading to a denial of service for all DNS resolution requests that it handles.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-13204 leads to a complete denial of service for the affected BIND 9 DNS resolver. This can prevent users and systems reliant on the compromised resolver from accessing internet resources, causing significant operational disruption. With a CVSS v3.1 Base Score of 7.5 (High), this vulnerability poses a severe risk to organizations running vulnerable BIND 9 instances. The impact is network-wide, as DNS is a fundamental service for internet communication. Any organization utilizing affected BIND 9 versions for their DNS infrastructure is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize patching all affected BIND 9 instances to a fixed version as soon as possible, referencing the security advisories linked in this brief. Specific versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1 are affected.\u003c/li\u003e\n\u003cli\u003eMonitor BIND 9 server logs for unexpected process terminations or assertion failures, which may indicate attempted exploitation of CVE-2026-13204.\u003c/li\u003e\n\u003cli\u003eEnsure robust monitoring and alerting for DNS service availability to quickly detect and respond to potential denial-of-service events on BIND 9 servers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:23:36Z","date_published":"2026-07-22T15:23:36Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13204-bind-dos/","summary":"A critical vulnerability (CVE-2026-13204) in Internet Systems Consortium (ISC) BIND 9 can lead to a denial-of-service condition where the server exits unexpectedly due to an assertion failure during DNSSEC validation of specific NSEC/NSEC3 record configurations. This allows an unauthenticated attacker to cause a BIND 9 DNS resolver to crash, disrupting DNS resolution services.","title":"CVE-2026-13204: BIND 9 Denial-of-Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13204-bind-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-12617"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.18.0 through 9.18.50)","BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.18.11-S1 through 9.18.50-S1)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","dns","bind","linux"],"_cs_type":"advisory","_cs_vendors":["ISC"],"content_html":"\u003cp\u003eCVE-2026-12617 describes a denial-of-service (DoS) vulnerability impacting the \u003ccode\u003enamed\u003c/code\u003e resolver in various versions of BIND 9. This critical issue stems from how the \u003ccode\u003enamed\u003c/code\u003e process handles specific, delayed, or out-of-order DNS responses, particularly for CNAME, DNAME, and A records. An attacker, by controlling or compromising an authoritative DNS server, can craft a scenario where a client queries for certain record types (e.g., DNAME and an A record below it, or a CNAME and an A record for the same name). If the authoritative server then delivers a positive A record response but delays and subsequently provides a negative DNAME response or a self-referential CNAME response, the \u003ccode\u003enamed\u003c/code\u003e process can terminate unexpectedly. This vulnerability affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, and specific S1 versions, leading to a disruption of DNS resolution services.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA client system initiates DNS queries to a vulnerable BIND 9 \u003ccode\u003enamed\u003c/code\u003e resolver.\u003c/li\u003e\n\u003cli\u003eThe client's query specifically requests a DNAME record and an A record located hierarchically below that DNAME, or requests a CNAME record and an A record for the same name.\u003c/li\u003e\n\u003cli\u003eA malicious or compromised authoritative DNS server intercepts these queries or is the designated authority.\u003c/li\u003e\n\u003cli\u003eThe malicious authoritative server immediately responds to the A record query with a positive resolution.\u003c/li\u003e\n\u003cli\u003eConcurrently, the authoritative server intentionally delays its response to the DNAME or CNAME query.\u003c/li\u003e\n\u003cli\u003eAfter a delay, the authoritative server sends a negative response for the DNAME query or a self-referential CNAME response for the CNAME query.\u003c/li\u003e\n\u003cli\u003eThe vulnerable BIND 9 \u003ccode\u003enamed\u003c/code\u003e resolver, processing these out-of-order or specific responses, encounters an unexpected internal state.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003enamed\u003c/code\u003e process terminates abruptly, resulting in a denial of service for DNS resolution services provided by that instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-12617 leads directly to a denial of service (DoS) for the affected BIND 9 \u003ccode\u003enamed\u003c/code\u003e resolver. When the \u003ccode\u003enamed\u003c/code\u003e process terminates unexpectedly, it ceases to resolve DNS queries, rendering any services relying on that DNS server unreachable. This can disrupt critical network functions, internal and external website access, email delivery, and any other system dependent on DNS resolution. The impact can range from temporary outages to prolonged service interruptions depending on the organization's DNS infrastructure and recovery procedures.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-12617 immediately by upgrading all affected BIND 9 installations to the patched versions provided by ISC.\u003c/li\u003e\n\u003cli\u003eMonitor DNS server health and process uptime for \u003ccode\u003enamed\u003c/code\u003e using host-level monitoring tools (e.g., \u003ccode\u003esystemd\u003c/code\u003e, \u003ccode\u003emonit\u003c/code\u003e, \u003ccode\u003enagios\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eImplement robust logging for DNS query and response anomalies to potentially identify unusual response patterns that could precede or indicate exploitation attempts of CVE-2026-12617.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:22:33Z","date_published":"2026-07-22T15:22:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-12617-bind-dos/","summary":"This vulnerability affects BIND 9 resolver (`named`) and can lead to unexpected program termination (denial of service). The issue occurs when the resolver receives specific, delayed, or out-of-order responses to queries for CNAME or DNAME and A records. Specifically, if an authoritative server delays a DNAME or self-referential CNAME response while providing an A record, the `named` process may crash.","title":"CVE-2026-12617: BIND 9 Denial of Service via Malicious DNS Responses","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-12617-bind-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-11622"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.11.0 through 9.18.50)","BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.21.0 through 9.21.23)","BIND 9 (9.11.3-S1 through 9.18.50-S1)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["high"],"_cs_tags":["dns","denial-of-service","vulnerability","isc","bind","cache-poisoning","network"],"_cs_type":"advisory","_cs_vendors":["ISC"],"content_html":"\u003cp\u003eCVE-2026-11622 details a critical vulnerability affecting multiple versions of ISC BIND 9, a widely used DNS software. This flaw impacts DNSSEC validating resolvers, allowing an unauthenticated attacker to trigger a denial-of-service (DoS) condition. The attack involves initiating a \u0026quot;random subdomain attack\u0026quot; against a DNSSEC-signed zone. By sending a high volume of queries for non-existent, random subdomains, the attacker can force the resolver to consume excessive memory. The vulnerability specifically targets BIND 9 versions from 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and their respective S1 branches (9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1). This uncontrolled memory growth can occur even when \u003ccode\u003emax-cache-size\u003c/code\u003e limits are configured, rendering the resolver unresponsive and disrupting critical DNS resolution services.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target BIND 9 DNSSEC validating resolver and a DNSSEC-signed zone that the resolver can query.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a flood of DNS queries for non-existent, random subdomains (e.g., \u003ccode\u003erandomstring.example.com\u003c/code\u003e) within the chosen DNSSEC-signed zone.\u003c/li\u003e\n\u003cli\u003eThe vulnerable BIND 9 resolver attempts to validate each unique non-existent subdomain query, a process that is computationally intensive for DNSSEC.\u003c/li\u003e\n\u003cli\u003eThe rate at which the attacker sends queries for new, random subdomains exceeds the resolver's capacity to complete DNSSEC validation for each request.\u003c/li\u003e\n\u003cli\u003eAs the resolver's cache attempts to store validation states for numerous unique, non-existent entries, its memory usage begins to increase rapidly.\u003c/li\u003e\n\u003cli\u003eThe memory consumption escalates significantly, potentially by orders of magnitude beyond any configured \u003ccode\u003emax-cache-size\u003c/code\u003e parameter due to the nature of DNSSEC validation state storage.\u003c/li\u003e\n\u003cli\u003eThe BIND 9 process exhausts available memory resources, leading to a crash or severe performance degradation, effectively causing a denial-of-service condition for all DNS queries.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11622 leads to a complete denial-of-service for affected BIND 9 DNSSEC validating resolvers. This means that organizations relying on these resolvers will experience service outages for DNS resolution, preventing access to internal and external resources that depend on DNS. The impact can be severe for internet service providers, enterprises, and other entities running vulnerable BIND instances, causing widespread network disruptions and unavailability of critical applications. The memory exhaustion can persist even with cache size limits, making manual intervention necessary to restore service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-11622 on all affected BIND 9 instances immediately by upgrading to a version where the vulnerability is resolved. Consult ISC advisories for specific patched versions.\u003c/li\u003e\n\u003cli\u003eMonitor DNS server resource utilization (CPU, memory, network I/O) for anomalies. Sudden spikes in memory usage on BIND 9 servers could indicate an attempted or ongoing exploitation of CVE-2026-11622.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on incoming DNS queries where feasible to mitigate the impact of high-volume attacks, though this may not fully prevent memory exhaustion for CVE-2026-11622.\u003c/li\u003e\n\u003cli\u003eReview DNS query logs for unusual patterns, such as a high volume of queries for random, non-existent subdomains from a single source or a small set of sources, which could indicate a random subdomain attack.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:22:02Z","date_published":"2026-07-22T15:20:51Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-11622-dnssec-memory-dos/","summary":"A DNSSEC validating resolver, specifically BIND 9 versions within the ranges 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and their S1 variants, is vulnerable to a denial-of-service attack where an attacker can launch a random subdomain attack against a DNSSEC-signed zone by sending queries faster than the resolver can perform validation, leading to runaway memory usage and potentially exceeding configured limits by orders of magnitude.","title":"CVE-2026-11622: BIND 9 DNSSEC Resolver Memory Exhaustion Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-11622-dnssec-memory-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-11605"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.21.0 through 9.21.23)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["low"],"_cs_tags":["dns","dnssec","vulnerability","denial-of-service","resource-exhaustion"],"_cs_type":"advisory","_cs_vendors":["Internet Systems Consortium (ISC)"],"content_html":"\u003cp\u003eA high-severity resource exhaustion vulnerability, identified as CVE-2026-11605, has been discovered in multiple versions of ISC BIND 9. This flaw stems from BIND's DNSSEC validation process, which validates all RRSIG (DNSSEC Signature) records in a DNS answer, even if they are not strictly necessary for the query's resolution. An attacker can exploit this by sending a crafted DNS response containing numerous valid but superfluous RRSIG records from an authoritative server they control. When a vulnerable BIND resolver processes such a response, it wastes disproportionate CPU time on unnecessary validation, leading to resource exhaustion and potential denial of service for critical DNS resolution services. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a vulnerable BIND 9 recursive resolver.\u003c/li\u003e\n\u003cli\u003eThe attacker operates or compromises an authoritative DNS server for a domain.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts DNSSEC records to include an excessive number of valid but superfluous RRSIG records for the controlled domain.\u003c/li\u003e\n\u003cli\u003eThe vulnerable BIND 9 resolver makes a DNS query that necessitates resolution via the attacker's authoritative server.\u003c/li\u003e\n\u003cli\u003eThe attacker's authoritative server responds to the BIND 9 resolver with the crafted DNSSEC response containing numerous RRSIG records.\u003c/li\u003e\n\u003cli\u003eThe vulnerable BIND 9 resolver attempts to validate all received RRSIG records, regardless of their necessity.\u003c/li\u003e\n\u003cli\u003eThis excessive validation process consumes a disproportionate amount of CPU time on the BIND 9 resolver.\u003c/li\u003e\n\u003cli\u003eThe BIND 9 resolver experiences resource exhaustion, leading to a denial of service condition for DNS resolution services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11605 results in a denial of service (DoS) for the affected BIND 9 DNS resolver. This can significantly disrupt network operations by preventing users and systems from resolving domain names, thereby impacting access to websites, applications, and other network services. The impact is primarily on the availability of DNS services, leading to widespread outages for any clients relying on the compromised resolver. The vulnerability has a CVSS v3.1 Base Score of 7.5 (High), reflecting its significant impact on availability without requiring authentication or user interaction.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-11605 immediately by upgrading affected BIND 9 instances to versions 9.20.25, 9.21.24, or later. Refer to the ISC download links in the references.\u003c/li\u003e\n\u003cli\u003eMonitor the CPU utilization of BIND 9 servers for unusual spikes, which could indicate an attempted or successful resource exhaustion attack due to CVE-2026-11605.\u003c/li\u003e\n\u003cli\u003eReview DNS traffic patterns for unusually large DNSSEC responses, specifically those containing an excessive number of RRSIG records, which could be an indicator of an attack targeting CVE-2026-11605.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:19:51Z","date_published":"2026-07-22T15:19:51Z","id":"https://feed.craftedsignal.io/briefs/2026-07-bind9-resource-exhaustion/","summary":"A resource exhaustion vulnerability, CVE-2026-11605, affects specific versions of ISC BIND 9, where DNSSEC validation disproportionately consumes CPU resources when processing superfluous RRSIG records, potentially leading to a denial of service.","title":"Resource Exhaustion Vulnerability in BIND 9 DNSSEC Validation (CVE-2026-11605)","url":"https://feed.craftedsignal.io/briefs/2026-07-bind9-resource-exhaustion/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-11331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BIND 9 (9.16.0 through 9.18.50)","BIND 9 (9.20.0 through 9.20.24)","BIND 9 (9.21.0 through 9.21.23)","BIND 9 (9.16.8-S1 through 9.18.50-S1)","BIND 9 (9.20.9-S1 through 9.20.24-S1)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","denial-of-service","dns","bind","networking"],"_cs_type":"advisory","_cs_vendors":["ISC"],"content_html":"\u003cp\u003eCVE-2026-11331 describes a significant vulnerability in multiple versions of ISC BIND 9, a widely used DNS software. This flaw specifically impacts BIND 9 resolvers configured with Response Policy Zones (RPZ) that utilize wildcard CNAME policies. An attacker, by discerning or guessing this configuration, can intentionally craft DNS query names of excessive length. This action triggers a \u0026quot;NAMETOOLONG\u0026quot; error condition during BIND 9's RPZ processing. Crucially, the software does not handle this error condition gracefully, which can lead to two critical outcomes: the successful bypass of the configured RPZ rules, allowing access to domains that should be blocked, or an unexpected termination of the BIND 9 process itself, resulting in a denial of service (DoS) for DNS resolution. The affected versions span from 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and specific \u0026quot;S1\u0026quot; branches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target DNS resolver running a vulnerable version of BIND 9 and determines or infers that it utilizes RPZ with wildcard CNAME policies.\u003c/li\u003e\n\u003cli\u003eThe attacker constructs a specialized DNS query containing an unusually long query name.\u003c/li\u003e\n\u003cli\u003eThe crafted query name is engineered to exceed the internal buffer or processing limits within BIND 9's RPZ component.\u003c/li\u003e\n\u003cli\u003eThe vulnerable BIND 9 instance receives the malicious query and attempts to process the long query name against its configured RPZ rules.\u003c/li\u003e\n\u003cli\u003eDuring this RPZ processing, the excessive length of the query name triggers an internal \u0026quot;NAMETOOLONG\u0026quot; error condition within BIND 9.\u003c/li\u003e\n\u003cli\u003eDue to the improper handling of this specific error, the BIND 9 resolver fails to correctly enforce the RPZ rule.\u003c/li\u003e\n\u003cli\u003eThis mishandling results in either the bypass of the intended RPZ rule, allowing the attacker to resolve a domain that should have been blocked, or causes the BIND 9 process to terminate unexpectedly.\u003c/li\u003e\n\u003cli\u003eIf the BIND 9 process terminates, it leads to a denial-of-service condition, impacting DNS resolution for clients relying on that server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impacts of successful exploitation of CVE-2026-11331 are the circumvention of security policies and service disruption. If an attacker bypasses Response Policy Zone (RPZ) rules, they can access or direct users to malicious domains that were intended to be blocked, thereby undermining the organization's network security posture. Alternatively, the vulnerability can lead to an unexpected termination of the BIND 9 software, causing a denial of service. This can severely disrupt DNS resolution services for an organization, rendering internal and external services inaccessible, and impacting operational continuity. The CVSS v3.1 Base Score of 7.5 indicates a high severity threat, primarily due to the high availability impact and moderate integrity impact (through RPZ bypass).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-11331 by upgrading all affected BIND 9 instances to a fixed version immediately.\u003c/li\u003e\n\u003cli\u003eMonitor BIND 9 logs for \u003ccode\u003eNAMETOOLONG\u003c/code\u003e error messages, especially those occurring during RPZ processing.\u003c/li\u003e\n\u003cli\u003eImplement proactive monitoring for unexpected termination or restarts of the BIND 9 process, as this may indicate a denial-of-service attack or critical error condition.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T15:19:04Z","date_published":"2026-07-22T15:19:04Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-11331-bind9-rpz-bypass-dos/","summary":"An attacker can exploit CVE-2026-11331, a flaw in ISC BIND 9's RPZ (Response Policy Zone) processing, by crafting long query names to trigger a mishandled NAMETOOLONG error, leading to either a bypass of RPZ rules or a denial of service due to an unexpected exit of the BIND 9 software.","title":"CVE-2026-11331: BIND 9 RPZ Bypass and Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-11331-bind9-rpz-bypass-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - BIND 9 (9.20.0 Through 9.20.24)","version":"https://jsonfeed.org/version/1.1"}