CVE-2026-13204: BIND 9 DNS DoS Vulnerability

CVE-2026-13204 Overview

CVE-2026-13204 is an assertion failure vulnerability in ISC BIND 9 that triggers when the resolver validates DNSSEC proofs for provably insecure domains. The flaw occurs when a domain is covered by both NSEC and NSEC3 records at the parent zone, but an RRSIG exists for only one of the two record types. During validation, BIND hits an unexpected assertion and exits, terminating the named process. The issue is tracked as CWE-617: Reachable Assertion and affects a wide range of stable and subscription BIND releases.

Critical Impact
A remote unauthenticated attacker can crash recursive BIND resolvers by inducing validation of a crafted DNSSEC response, producing a denial-of-service condition against DNS infrastructure.

Affected Products

BIND 9 versions 9.11.0 through 9.18.50
BIND 9 versions 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-13204 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13204

Vulnerability Analysis

BIND 9 uses DNSSEC to authenticate DNS responses, including negative answers that prove a name does not exist or that a zone is unsigned. Parent zones can express insecure delegation using either NSEC or NSEC3 records, each accompanied by an RRSIG signature. CVE-2026-13204 arises when both NSEC and NSEC3 records cover the same provably insecure delegation, but only one of the two carries a valid RRSIG. The validator does not gracefully handle this asymmetric state and triggers an internal assertion, forcing named to abort.

Root Cause

The defect is a reachable assertion inside the DNSSEC negative-proof validation path. The code assumes that if both NSEC and NSEC3 proofs are present at the parent, they share a consistent signing state. When only one record type has an RRSIG, an invariant check fails and the process exits, rather than returning a soft validation failure.

Attack Vector

Exploitation requires no authentication or user interaction and is reachable over the network. An attacker who controls an authoritative nameserver, or who can inject responses in-path, returns a crafted delegation containing both NSEC and NSEC3 coverage with a missing signature on one type. Any recursive BIND resolver querying the zone will validate the proof and terminate, resulting in denial of service for downstream DNS clients.

No verified public exploit code is available. See the ISC CVE-2026-13204 Documentation for authoritative technical detail.

Detection Methods for CVE-2026-13204

Indicators of Compromise

Unexpected named process termination with assertion failure messages in BIND logs, typically referencing the validator module.
Repeated resolver restarts or crash loops correlated with queries to specific external domains.
DNS resolution outages for clients relying on affected recursive resolvers.

Detection Strategies

Monitor named logs for assertion failure and exiting strings emitted by the DNSSEC validator.
Alert on abnormal restart counts for BIND services under systemd, launchd, or equivalent process supervisors.
Correlate resolver crashes with recent recursive lookups to identify the triggering domain and upstream authoritative servers.

Monitoring Recommendations

Ingest BIND named logs and process telemetry into a centralized analytics platform to baseline crash frequency.
Track DNSSEC validation failure metrics exposed through rndc stats and BIND statistics channels.
Enable query logging temporarily on canary resolvers to capture the domain names preceding validator exits.

How to Mitigate CVE-2026-13204

Immediate Actions Required

Upgrade BIND 9 to a patched release from ISC as soon as maintenance windows allow.
Inventory all internal recursive resolvers and confirm version and DNSSEC validation state.
Ensure automatic restart is configured for named to reduce outage duration while patching is scheduled.

Patch Information

ISC has published fixed releases including ISC BIND 9.20.26 and ISC BIND 9.21.24. Subscription Edition customers should obtain the corresponding -S1 releases from ISC. Consult the ISC CVE-2026-13204 Documentation for the complete list of fixed versions and upgrade guidance.

Workarounds

Disable DNSSEC validation on affected resolvers by setting dnssec-validation no; in named.conf, accepting the loss of DNSSEC integrity guarantees as a trade-off.
Restrict recursion to trusted client networks using allow-recursion access control lists to limit attacker-controlled query paths.
Front vulnerable resolvers with an unaffected DNS resolver implementation until patches are deployed.

bash

# Configuration example: temporarily disable DNSSEC validation in named.conf
options {
    directory "/var/named";
    recursion yes;
    allow-recursion { trusted_clients; };
    dnssec-validation no;
};