This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] BIND 9 fixes 9 vulnerabilities

BIND 9 fixes 9 vulnerabilities in BIND 9 and BIND Supported Preview Edition [1][2]. A selection of the most severe vulnerabilities is described below; the rest can be found at [1]. Products and their fixed versions [1]: BIND 9 - 9.20.26, 9.21.24 BIND Supported Preview Edition - 9.20.26-S1 Debian releases and their fixed versions [3]: trixie (security) - 1:9.20.26-1~deb13u1

BIND 9 - DNSSEC validation bypass (CVE-2026-13321)
CVSS 8.6 (High)

An unauthenticated remote attacker can bypass DNSSEC validation on BIND resolvers by creating a validly signed NSEC record whose "Next Domain Name" field points outside the boundaries of the zone in which it was signed. An attacker controlling a signed zone can thus forge an authenticated denial-of-existence response for a zone they do not control [4].

The vulnerability is present in products:

  • BIND 9; >=9.11.0, <=9.18.50; >=9.20.0, <=9.20.24; >=9.21.0, <=9.21.23;
  • BIND 9 Supported Preview Edition; >=9.11.3-S1, <=9.18.50-S1; >=9.20.9-S1, <=9.20.24-S1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

More information:

The vulnerability was publicly disclosed 22. 7. 2026.

BIND 9 - RPZ policy bypass, service crash (CVE-2026-11331)
CVSS 8.2 (High)

An unauthenticated remote attacker can, by sending a query with a sufficiently long name to a BIND resolver using RPZ (Response Policy Zones) with a wildcard CNAME policy, trigger a NAMETOOLONG error and thereby bypass the given RPZ rule, or cause the service to crash [5].

The vulnerability is present in products:

  • BIND 9; >=9.11.0, <=9.18.50; >=9.20.0, <=9.20.24; >=9.21.0, <=9.21.23;
  • BIND 9 Supported Preview Edition; >=9.11.3-S1, <=9.18.50-S1; >=9.20.9-S1, <=9.20.24-S1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

More information:

The vulnerability was publicly disclosed 22. 7. 2026.

BIND 9 - cache poisoning (CVE-2026-11721)
CVSS 7.5 (High)

An unauthenticated remote attacker can, on BIND resolvers with the default setting "synth-from-dnssec yes", perform a cache poisoning attack using an RRSIG record with an incorrect label count, based on which the resolver incorrectly derives a wildcard record of a foreign zone [6][7].

The vulnerability is present in products:

  • BIND 9; >=9.11.0, <=9.18.50; >=9.20.0, <=9.20.24; >=9.21.0, <=9.21.23;
  • BIND 9 Supported Preview Edition; >=9.11.3-S1, <=9.18.50-S1; >=9.20.9-S1, <=9.20.24-S1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

More information:

The vulnerability was publicly disclosed 22. 7. 2026.

By CESNET, z.s.p.o. Pavla Hlučková on 23. 7. 2026.

CESNET, z.s.p.o. Logo