CVE-2026-11331 Overview
CVE-2026-11331 affects the Internet Systems Consortium (ISC) BIND 9 DNS resolver. The flaw resides in Response Policy Zone (RPZ) processing when wildcard CNAME policies are configured. An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition. BIND 9 does not handle this error correctly, which can defeat the RPZ rule or cause an unexpected process exit. The issue is classified under [CWE-790] (Improper Filtering of Special Elements) and is remotely exploitable without authentication.
Critical Impact
Remote attackers can bypass RPZ filtering policies or terminate the BIND 9 process, disrupting DNS resolution for downstream clients.
Affected Products
- ISC BIND 9 versions 9.16.0 through 9.18.50
- ISC BIND 9 versions 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
- ISC BIND 9 Supported Preview Edition versions 9.16.8-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1
Discovery Timeline
- 2026-07-22 - CVE-2026-11331 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-11331
Vulnerability Analysis
BIND 9 supports Response Policy Zones (RPZ), a filtering mechanism administrators use to rewrite DNS responses for policy enforcement. When an RPZ rule uses a wildcard CNAME target, BIND expands the wildcard and constructs a synthesized name during query processing.
The vulnerability occurs when the constructed name exceeds DNS name length limits, producing a NAMETOOLONG error. The RPZ processing code does not handle this error correctly. As a result, the intended RPZ policy is not applied to the query, or the resolver process terminates unexpectedly.
Exploitation requires no authentication and no user interaction. An attacker only needs network reachability to the resolver and knowledge that RPZ with wildcard CNAME policies is in use.
Root Cause
The root cause is improper error handling during RPZ policy evaluation. When BIND synthesizes a name from a wildcard CNAME rule and that name exceeds the maximum DNS name length of 255 octets, the resulting NAMETOOLONG condition is not gracefully processed. The code path either abandons the RPZ decision or reaches an assertion that terminates the daemon.
Attack Vector
The attack vector is remote and unauthenticated. An attacker sends DNS queries with abnormally long query names to a target resolver that uses RPZ with wildcard CNAME rules. Repeated crafted queries either bypass filtering policies enforced by RPZ or crash the named process, causing denial of service for all clients relying on the resolver.
No public exploit code has been published. Refer to the ISC CVE-2026-11331 Documentation for vendor technical details.
Detection Methods for CVE-2026-11331
Indicators of Compromise
- Unexpected termination or restart events for the named process on resolvers with RPZ enabled
- DNS query logs containing unusually long query names, particularly those approaching the 255-octet DNS name limit
- RPZ policy hits followed by resolver errors or NAMETOOLONG messages in BIND logs
Detection Strategies
- Enable BIND query logging and RPZ logging, then alert on NAMETOOLONG or RPZ processing errors
- Monitor named process uptime and generate alerts on unplanned restarts
- Inspect DNS traffic for queries with label lengths or total name lengths near protocol maximums originating from external sources
Monitoring Recommendations
- Forward BIND logs to a centralized logging platform and create detections for repeated RPZ evaluation failures
- Track query name length distributions to identify statistical anomalies indicative of crafted probing
- Correlate resolver crashes with source IPs of preceding long-name queries to identify likely attackers
How to Mitigate CVE-2026-11331
Immediate Actions Required
- Upgrade BIND 9 to a fixed release from ISC before exposing resolvers with RPZ wildcard CNAME rules to untrusted networks
- Inventory all resolvers using RPZ and identify which policies contain wildcard CNAME targets
- Restrict resolver access to authorized client networks using ACLs where operationally feasible
Patch Information
ISC has released fixed versions. Upgrade to BIND 9.20.26 or BIND 9.21.24. Consult the ISC CVE-2026-11331 Documentation for the complete list of patched releases including Supported Preview Edition builds.
Workarounds
- Remove wildcard CNAME entries from RPZ configurations until patching is complete
- Replace wildcard CNAME policies with explicit CNAME targets or alternative RPZ actions such as NXDOMAIN or PASSTHRU
- Rate-limit DNS queries with excessive name lengths at upstream network devices or DNS firewalls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
