CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.26
https://downloads.isc.org/isc/bind9/9.21.24
https://kb.isc.org/docs/cve-2026-11721

Configurations

No configuration.

History

24 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Es posible que la zona de un atacante responda a una consulta con un RRSIG que tiene un número menor de etiquetas que la zona en la que está contenido el RRSIG. Esto hace que “named” produzca un nombre comodín para una zona que es más corta que la zona del atacante, lo que puede resultar en envenenamiento de caché. Para que este ataque tenga algún efecto, el resolvedor bajo ataque debe haber configurado “synth-from-dnssec yes;” (que es el valor predeterminado). Este problema afecta a las versiones de BIND 9 9.11.0 a 9.18.50, 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, 9.11.3-S1 a 9.18.50-S1, y 9.20.9-S1 a 9.20.24-S1.

Information

Published : 2026-07-22 15:16

Updated : 2026-10-24 18:10

NVD link : CVE-2026-11721

Mitre link : CVE-2026-11721

CVE.ORG link : CVE-2026-11721

JSON object : View

Products Affected

No product.

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-11721", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:52:35.390125Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.24"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.23"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.24-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T15:16:51.837", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.26", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.24", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-11721", "source": "security-officer@isc.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default).\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."}, {"lang": "es", "value": "Es posible que la zona de un atacante responda a una consulta con un RRSIG que tiene un n\u00famero menor de etiquetas que la zona en la que est\u00e1 contenido el RRSIG. Esto hace que \u201cnamed\u201d produzca un nombre comod\u00edn para una zona que es m\u00e1s corta que la zona del atacante, lo que puede resultar en envenenamiento de cach\u00e9. Para que este ataque tenga alg\u00fan efecto, el resolvedor bajo ataque debe haber configurado \u201csynth-from-dnssec yes;\u201d (que es el valor predeterminado).\nEste problema afecta a las versiones de BIND 9 9.11.0 a 9.18.50, 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, 9.11.3-S1 a 9.18.50-S1, y 9.20.9-S1 a 9.20.24-S1."}], "lastModified": "2026-10-24T18:10:00.163", "sourceIdentifier": "security-officer@isc.org"}