Impact

Successful exploitation of CVE-2026-13321 could lead to significant integrity compromises within organizations reliant on vulnerable BIND resolvers. The high integrity impact (I:H) indicated by the CVSS score suggests that an attacker could inject malicious or incorrect data into the DNS cache. This cache poisoning could enable DNS spoofing, where users are redirected to attacker-controlled websites instead of legitimate ones. Such redirection can facilitate phishing attacks, credential harvesting, or the delivery of malware. Organizations, regardless of sector, that use affected BIND versions for DNS resolution are vulnerable to these attacks, potentially leading to data breaches, service disruptions, and reputational damage.

Recommendation

• Immediately update all affected BIND 9 installations to patched versions available from ISC to remediate CVE-2026-13321. Specifically, update BIND 9.18.50 to 9.18.51, 9.20.24 to 9.20.26, and 9.21.23 to 9.21.24 or newer as referenced in the ISC advisory.
• Regularly monitor DNS query and response logs for anomalies, especially around NSEC records or unexpected domain resolutions, to detect potential exploitation attempts.

Attack Chain

1. An attacker controls an authoritative DNS server for a malicious domain.
2. The attacker configures their authoritative server to serve the parent zone of the malicious domain with both NSEC and NSEC3 records.
3. The attacker deliberately ensures that an RRSIG (DNSSEC signature) is present for only one of these record types (either NSEC or NSEC3), but not both, for the malicious domain's non-existent records.
4. A vulnerable BIND 9 DNS resolver attempts to validate a query for a non-existent record within this malicious domain.
5. During DNSSEC validation, the BIND resolver attempts to process the insecure domain's NSEC and NSEC3 records and their RRSIGs as provided by the attacker-controlled authoritative server.
6. Due to the specific and malformed configuration (presence of both NSEC/NSEC3 records with an RRSIG for only one), the BIND resolver encounters an assertion failure within its validation logic.
7. The BIND 9 server process exits unexpectedly, leading to a denial of service for all DNS resolution requests that it handles.

Impact

Successful exploitation of CVE-2026-13204 leads to a complete denial of service for the affected BIND 9 DNS resolver. This can prevent users and systems reliant on the compromised resolver from accessing internet resources, causing significant operational disruption. With a CVSS v3.1 Base Score of 7.5 (High), this vulnerability poses a severe risk to organizations running vulnerable BIND 9 instances. The impact is network-wide, as DNS is a fundamental service for internet communication. Any organization utilizing affected BIND 9 versions for their DNS infrastructure is at risk.

Recommendation

• Prioritize patching all affected BIND 9 instances to a fixed version as soon as possible, referencing the security advisories linked in this brief. Specific versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1 are affected.
• Monitor BIND 9 server logs for unexpected process terminations or assertion failures, which may indicate attempted exploitation of CVE-2026-13204.
• Ensure robust monitoring and alerting for DNS service availability to quickly detect and respond to potential denial-of-service events on BIND 9 servers.

Attack Chain

1. An attacker identifies a target BIND 9 DNSSEC validating resolver and a DNSSEC-signed zone that the resolver can query.
2. The attacker initiates a flood of DNS queries for non-existent, random subdomains (e.g., randomstring.example.com) within the chosen DNSSEC-signed zone.
3. The vulnerable BIND 9 resolver attempts to validate each unique non-existent subdomain query, a process that is computationally intensive for DNSSEC.
4. The rate at which the attacker sends queries for new, random subdomains exceeds the resolver's capacity to complete DNSSEC validation for each request.
5. As the resolver's cache attempts to store validation states for numerous unique, non-existent entries, its memory usage begins to increase rapidly.
6. The memory consumption escalates significantly, potentially by orders of magnitude beyond any configured max-cache-size parameter due to the nature of DNSSEC validation state storage.
7. The BIND 9 process exhausts available memory resources, leading to a crash or severe performance degradation, effectively causing a denial-of-service condition for all DNS queries.

Impact

Successful exploitation of CVE-2026-11622 leads to a complete denial-of-service for affected BIND 9 DNSSEC validating resolvers. This means that organizations relying on these resolvers will experience service outages for DNS resolution, preventing access to internal and external resources that depend on DNS. The impact can be severe for internet service providers, enterprises, and other entities running vulnerable BIND instances, causing widespread network disruptions and unavailability of critical applications. The memory exhaustion can persist even with cache size limits, making manual intervention necessary to restore service.

Recommendation

• Patch CVE-2026-11622 on all affected BIND 9 instances immediately by upgrading to a version where the vulnerability is resolved. Consult ISC advisories for specific patched versions.
• Monitor DNS server resource utilization (CPU, memory, network I/O) for anomalies. Sudden spikes in memory usage on BIND 9 servers could indicate an attempted or ongoing exploitation of CVE-2026-11622.
• Implement rate limiting on incoming DNS queries where feasible to mitigate the impact of high-volume attacks, though this may not fully prevent memory exhaustion for CVE-2026-11622.
• Review DNS query logs for unusual patterns, such as a high volume of queries for random, non-existent subdomains from a single source or a small set of sources, which could indicate a random subdomain attack.

Attack Chain

1. An attacker identifies a vulnerable BIND 9 recursive resolver.
2. The attacker operates or compromises an authoritative DNS server for a domain.
3. The attacker crafts DNSSEC records to include an excessive number of valid but superfluous RRSIG records for the controlled domain.
4. The vulnerable BIND 9 resolver makes a DNS query that necessitates resolution via the attacker's authoritative server.
5. The attacker's authoritative server responds to the BIND 9 resolver with the crafted DNSSEC response containing numerous RRSIG records.
6. The vulnerable BIND 9 resolver attempts to validate all received RRSIG records, regardless of their necessity.
7. This excessive validation process consumes a disproportionate amount of CPU time on the BIND 9 resolver.
8. The BIND 9 resolver experiences resource exhaustion, leading to a denial of service condition for DNS resolution services.

Impact

Successful exploitation of CVE-2026-11605 results in a denial of service (DoS) for the affected BIND 9 DNS resolver. This can significantly disrupt network operations by preventing users and systems from resolving domain names, thereby impacting access to websites, applications, and other network services. The impact is primarily on the availability of DNS services, leading to widespread outages for any clients relying on the compromised resolver. The vulnerability has a CVSS v3.1 Base Score of 7.5 (High), reflecting its significant impact on availability without requiring authentication or user interaction.

Recommendation

• Patch CVE-2026-11605 immediately by upgrading affected BIND 9 instances to versions 9.20.25, 9.21.24, or later. Refer to the ISC download links in the references.
• Monitor the CPU utilization of BIND 9 servers for unusual spikes, which could indicate an attempted or successful resource exhaustion attack due to CVE-2026-11605.
• Review DNS traffic patterns for unusually large DNSSEC responses, specifically those containing an excessive number of RRSIG records, which could be an indicator of an attack targeting CVE-2026-11605.

Attack Chain

1. An attacker identifies a target DNS resolver running a vulnerable version of BIND 9 and determines or infers that it utilizes RPZ with wildcard CNAME policies.
2. The attacker constructs a specialized DNS query containing an unusually long query name.
3. The crafted query name is engineered to exceed the internal buffer or processing limits within BIND 9's RPZ component.
4. The vulnerable BIND 9 instance receives the malicious query and attempts to process the long query name against its configured RPZ rules.
5. During this RPZ processing, the excessive length of the query name triggers an internal "NAMETOOLONG" error condition within BIND 9.
6. Due to the improper handling of this specific error, the BIND 9 resolver fails to correctly enforce the RPZ rule.
7. This mishandling results in either the bypass of the intended RPZ rule, allowing the attacker to resolve a domain that should have been blocked, or causes the BIND 9 process to terminate unexpectedly.
8. If the BIND 9 process terminates, it leads to a denial-of-service condition, impacting DNS resolution for clients relying on that server.

Impact

The primary impacts of successful exploitation of CVE-2026-11331 are the circumvention of security policies and service disruption. If an attacker bypasses Response Policy Zone (RPZ) rules, they can access or direct users to malicious domains that were intended to be blocked, thereby undermining the organization's network security posture. Alternatively, the vulnerability can lead to an unexpected termination of the BIND 9 software, causing a denial of service. This can severely disrupt DNS resolution services for an organization, rendering internal and external services inaccessible, and impacting operational continuity. The CVSS v3.1 Base Score of 7.5 indicates a high severity threat, primarily due to the high availability impact and moderate integrity impact (through RPZ bypass).

Recommendation

• Patch CVE-2026-11331 by upgrading all affected BIND 9 instances to a fixed version immediately.
• Monitor BIND 9 logs for NAMETOOLONG error messages, especially those occurring during RPZ processing.
• Implement proactive monitoring for unexpected termination or restarts of the BIND 9 process, as this may indicate a denial-of-service attack or critical error condition.