CVE-2026-10723: BIND Information Disclosure Vulnerability

CVE-2026-10723 Overview

CVE-2026-10723 is a DNSSEC validation flaw in ISC BIND 9 that allows attackers to forge authenticated NXDOMAIN responses. The resolver accepts incorrect child-zone NSEC3 records as valid, breaking the trust guarantees DNSSEC is designed to provide [CWE-347: Improper Verification of Cryptographic Signature]. Affected versions include BIND 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the Supported Preview Editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1. ISC released fixed builds in BIND 9.20.26 and 9.21.24.

Critical Impact
Attackers can forge authenticated NXDOMAIN responses, enabling DNS response manipulation against DNSSEC-validating resolvers.

Affected Products

ISC BIND 9.18.0 through 9.18.50
ISC BIND 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
ISC BIND Supported Preview Editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-10723 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10723

Vulnerability Analysis

The vulnerability resides in how BIND 9 validates NSEC3 records returned from child zones during DNSSEC authentication. NSEC3 records provide authenticated denial of existence, proving that a queried domain name does not exist within a signed zone. BIND accepts NSEC3 records from a child zone context when they should not be authoritative for the proof being constructed. This validation gap breaks the chain-of-trust assumptions that DNSSEC resolvers rely on to reject forged responses.

Successful exploitation lets an attacker craft responses that a validating resolver will treat as legitimate NXDOMAIN answers. Downstream clients will then believe queried names do not exist, even when they do. The confidentiality impact is none, but integrity impact is high because DNS answers can be silently manipulated. The scope is changed, reflecting that the flaw in the resolver affects downstream clients trusting its answers.

Root Cause

The root cause is improper verification of a cryptographic signature context [CWE-347]. BIND's validator does not correctly enforce that NSEC3 records used to prove non-existence originate from the appropriate zone cut. Child-zone NSEC3 records are accepted where only parent-zone or same-zone records should satisfy the proof, allowing an attacker-controlled child zone to supply records that appear valid to the resolver.

Attack Vector

The attack is remote and does not require authentication or user interaction, but attack complexity is high because the attacker must control or influence a child zone and induce the target resolver to query it. Once conditions align, the attacker returns crafted NSEC3 records with a response that the resolver accepts as an authenticated denial of existence. This can be used to suppress the existence of legitimate records, enabling downgrade, denial, or redirection scenarios where fallback logic reacts to forged NXDOMAIN answers.

No verified public proof-of-concept code is available. See the ISC CVE-2026-10723 Documentation for the vendor's technical description.

Detection Methods for CVE-2026-10723

Indicators of Compromise

Unexpected NXDOMAIN responses for domains known to resolve successfully from other resolvers or authoritative servers.
DNSSEC validation logs from BIND (named) showing NSEC3 proofs accepted for names within delegated child zones under suspicious circumstances.
Sudden changes in resolution behavior for services whose failover logic depends on NXDOMAIN semantics.

Detection Strategies

Compare authenticated resolver answers against a known-good out-of-band DNSSEC validator to identify divergent NXDOMAIN responses.
Enable and review BIND query and validation logging (querylog and dnssec categories) for NSEC3 records associated with unexpected zone cuts.
Inventory all BIND instances and flag any running versions in the affected ranges listed by ISC.

Monitoring Recommendations

Alert on version strings from named -v matching vulnerable 9.18, 9.20, 9.21, or -S1 builds.
Track DNSSEC validation failure and success ratios over time to detect anomalous shifts after suspected exploitation attempts.
Correlate resolver logs with downstream application errors that reference NXDOMAIN or SERVFAIL results.

How to Mitigate CVE-2026-10723

Immediate Actions Required

Upgrade affected resolvers to BIND 9.20.26, 9.21.24, or the corresponding patched Supported Preview Edition build from ISC.
Identify all internal and edge DNS resolvers running vulnerable versions and prioritize patching those performing DNSSEC validation.
Review recent DNS resolution anomalies and application errors that may indicate forged NXDOMAIN responses were served.

Patch Information

ISC has released fixed builds. See the ISC BIND 9.20.26 Release and the ISC BIND 9.21.24 Release. Supported Preview Edition customers should obtain the corresponding -S1 update directly from ISC. Full vendor guidance is documented in the ISC CVE-2026-10723 Documentation.

Workarounds

No specific configuration workaround is published by ISC; upgrading to a fixed release is the supported remediation.
Where immediate patching is not possible, restrict recursive resolver access to trusted clients only to limit exposure of the validator to attacker-controlled queries.
Consider forwarding to an upstream resolver already running a patched BIND version or a different DNSSEC-validating implementation until upgrades complete.

bash

# Verify installed BIND version and upgrade path
named -v
# Example vulnerable output: BIND 9.20.24

# After package upgrade, confirm fixed version
named -v
# Expected output on fixed systems: BIND 9.20.26 or BIND 9.21.24