CVE-2026-11721: BIND 9 Cache Poisoning Vulnerability

CVE-2026-11721 Overview

CVE-2026-11721 is a cache poisoning vulnerability in ISC BIND 9 affecting the DNSSEC wildcard synthesis feature. An attacker who controls an authoritative zone can respond to a resolver query with a Resource Record Signature (RRSIG) containing a labels count smaller than the zone in which the RRSIG resides. The named resolver then synthesizes a wildcard name for a zone shorter than the attacker's own zone, poisoning the cache with attacker-influenced records. The flaw is classified under [CWE-1284] Improper Validation of Specified Quantity in Input. Exploitation requires the target resolver to have synth-from-dnssec yes; configured, which is the default setting in affected BIND versions.

Critical Impact
Remote unauthenticated attackers can poison DNS caches on BIND 9 resolvers running default DNSSEC configurations, redirecting traffic for arbitrary domains.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.24, and 9.21.0 through 9.21.23
ISC BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-11721 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-11721

Vulnerability Analysis

The vulnerability resides in how BIND 9 validates the labels field of an RRSIG record during DNSSEC synthesis. The RRSIG labels field indicates the number of labels in the original owner name used to create the signature, which resolvers use to determine whether a signed response was generated from a wildcard. BIND 9 fails to enforce that the labels count is bounded by the zone containing the RRSIG. An attacker's authoritative server can return an RRSIG with a labels count smaller than the zone owner name. named then treats the response as a wildcard synthesized from a name shorter than the attacker's zone, effectively allowing the attacker's zone to inject records into a parent namespace it does not control. Cached synthesized entries can redirect subsequent queries from any client using the resolver.

Root Cause

The root cause is missing validation between the RRSIG labels field and the zone hierarchy where the signature is presented. BIND 9 accepts the attacker-supplied labels count without confirming it falls within the boundaries of the signing zone. The synth-from-dnssec feature then uses this value to derive wildcard owner names, propagating attacker-controlled data into the cache.

Attack Vector

Exploitation requires an attacker to operate an authoritative DNS zone that a target BIND resolver will query. When the resolver requests names under the attacker's delegation, the attacker responds with a crafted RRSIG whose labels field is smaller than the delegated zone depth. The resolver synthesizes wildcard records for a shorter zone and stores them in cache. No authentication, user interaction, or local access is required. The attack is network-based and can be launched by luring a resolver into querying an attacker-controlled name, for example through embedded resources or referral chains. Detailed reproduction guidance is available in the ISC CVE-2026-11721 Documentation.

Detection Methods for CVE-2026-11721

Indicators of Compromise

Cached DNS records whose owner names do not align with the authoritative zone that supplied the RRSIG in named cache dumps.
RRSIG responses observed on the wire where the labels field is smaller than the number of labels in the signing zone.
Unexpected NXDOMAIN-to-positive transitions for names outside any attacker-delegated zone.

Detection Strategies

Inspect rndc dumpdb -cache output for synthesized wildcard entries that map high-value domains to unexpected data.
Enable BIND query and response logging (querylog, response-checks) and alert on RRSIGs with anomalous labels values relative to the QNAME.
Correlate resolver logs with passive DNS telemetry to detect drift between authoritative answers and cached responses.

Monitoring Recommendations

Forward BIND logs to a centralized analytics platform and build detections on RRSIG labels count anomalies.
Track the version and configuration state of synth-from-dnssec across all resolvers in inventory.
Monitor upstream advisories from ISC for updated indicators and detection signatures.

How to Mitigate CVE-2026-11721

Immediate Actions Required

Upgrade BIND 9 to a fixed release: 9.20.26, 9.21.24, or the equivalent Supported Preview Edition build.
Audit resolver configurations for synth-from-dnssec yes; and disable it on resolvers that cannot be patched immediately.
Restrict recursive resolver access to trusted clients using allow-query and allow-recursion access control lists.

Patch Information

ISC has released fixed builds. Refer to the ISC BIND 9.20.26 Release and the ISC BIND 9.21.24 Release for source packages. Supported Preview Edition customers should obtain the corresponding -S1 releases through the ISC support portal.

Workarounds

Set synth-from-dnssec no; in the resolver options block to disable wildcard synthesis until the resolver is patched.
Deploy Response Policy Zones (RPZ) to block resolution of high-value internal names through untrusted delegations.
Segment recursive resolvers behind firewall policies that limit which authoritative zones they will query.

bash

# Configuration example: disable synth-from-dnssec in named.conf
options {
    directory "/var/named";
    recursion yes;
    synth-from-dnssec no;
    allow-query { trusted-clients; };
    allow-recursion { trusted-clients; };
};