CVE-2026-10822: BIND 9 DNS Denial of Service Vulnerability

CVE-2026-10822 Overview

CVE-2026-10822 affects Internet Systems Consortium (ISC) BIND 9, the widely deployed Domain Name System (DNS) server software. When BIND processes a DNS key record (KEY, DNSKEY, or similar) that specifies the PRIVATEDNS algorithm (algorithm 253) with a length field larger than the actual identifier data, BIND accepts and stores the malformed record. A later attempt to render that record to text triggers a consistency check failure, causing the daemon to abort and exit.

The flaw is tracked under CWE-617: Reachable Assertion and results in denial of service against affected name servers.

Critical Impact
A remote actor able to place a crafted DNS key record into a zone served or processed by BIND can force the named process to abort, disrupting DNS resolution.

Affected Products

ISC BIND 9.18.0 through 9.18.50
ISC BIND 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
ISC BIND Supported Preview Edition 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-10822 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10822

Vulnerability Analysis

BIND supports DNS key records that carry cryptographic material for zones, including KEY and DNSKEY types. Each record specifies an algorithm identifier. Algorithm 253, PRIVATEDNS, allows implementations to define private algorithms and encodes the algorithm as a domain name inside the RDATA, prefixed by a length field.

The parser accepts the record even when the declared length exceeds the actual identifier data present in the RDATA buffer. The invalid length value is persisted alongside the record. When BIND later serializes the record to its textual presentation format, the render path trusts the stored length and reads or processes bytes that violate an internal invariant. A consistency check fires, the assertion fails, and named terminates.

Because the failure is triggered at render time rather than parse time, the malformed record can survive in caches, zone files, or replication paths before it causes an abort.

Root Cause

The root cause is insufficient validation of the PRIVATEDNS algorithm identifier length during record ingestion. BIND does not reconcile the declared identifier length against the remaining RDATA bytes, allowing an inconsistent structure to be stored. The subsequent reachable assertion in the text rendering routine converts a data validation defect into a process-terminating condition.

Attack Vector

Exploitation requires a target BIND instance to store a crafted DNS record and then render it. Suitable trigger paths include zone transfers containing the malformed record, cached responses from authoritative servers under attacker influence, dynamic updates, or administrative tooling that prints zone contents. The CVSS vector indicates a network attack vector with user interaction, reflecting that a downstream action, such as rendering the record, is required to trigger the abort. Repeated triggering produces sustained denial of service against the resolver or authoritative server.

No public proof-of-concept exploit is listed in the advisory. The vulnerability mechanism is described in the ISC advisory for CVE-2026-10822.

Detection Methods for CVE-2026-10822

Indicators of Compromise

Unexpected termination of the named process accompanied by assertion failure messages in BIND logs referencing RDATA rendering or key record processing.
Presence of DNSKEY, KEY, or related records specifying algorithm 253 (PRIVATEDNS) received from untrusted zones or peers.
Zone transfer or cache entries where the PRIVATEDNS algorithm identifier length exceeds the RDATA payload length.

Detection Strategies

Inspect DNS traffic and zone data for key records using algorithm 253 and validate that the embedded identifier length matches the remaining RDATA.
Alert on repeated named crashes or restarts within short intervals on authoritative and recursive resolvers.
Correlate BIND assertion-failure log entries with preceding zone transfers, dynamic updates, or recursive queries that could have introduced the malformed record.

Monitoring Recommendations

Monitor process supervision events for named exits and enable core dump collection to confirm the assertion path.
Track DNS query and response error rates, including SERVFAIL spikes, that follow resolver restarts.
Ingest BIND logs into a centralized logging platform and build detections keyed on assertion strings and abnormal shutdown reasons.

How to Mitigate CVE-2026-10822

Immediate Actions Required

Upgrade BIND to a fixed release: 9.18.51, 9.20.26, or 9.21.24, or the equivalent Supported Preview Edition build, per the ISC advisory.
Restrict zone transfers and dynamic updates to authenticated peers using TSIG and explicit ACLs.
Review upstream trust relationships and forwarders to reduce exposure to malformed records from untrusted sources.

Patch Information

ISC has published fixed builds available from the BIND 9.20.26 download directory and the BIND 9.21.24 download directory. Administrators running the Supported Preview Edition should obtain the corresponding -S1 builds from ISC. Apply the upgrade to all authoritative and recursive BIND instances, including hidden primaries and secondaries.

Workarounds

No configuration-only workaround is documented; upgrading is the supported remediation.
Where immediate patching is not possible, limit exposure by disabling zone transfers to untrusted peers and blocking recursive resolution from untrusted clients.
Configure process supervision (for example, systemd with Restart=on-abort) so named recovers quickly if the assertion is reached, while patching is scheduled.

bash

# Example systemd override to auto-restart named after an abort
# /etc/systemd/system/named.service.d/restart.conf
[Service]
Restart=on-abort
RestartSec=2s