CVE-2026-13321: BIND DNS Information Disclosure Flaw

CVE-2026-13321 Overview

CVE-2026-13321 affects the Internet Systems Consortium (ISC) BIND 9 resolver. The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside the signer's zone. This is an origin validation flaw classified under [CWE-346]. An attacker controlling an authoritative server can craft signed NSEC responses that reference names outside their zone, enabling the resolver to accept out-of-bailiwick assertions during DNSSEC validation. The issue impacts BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the Supported Preview (S1) editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1.

Critical Impact
Remote attackers can inject unauthorized NSEC assertions into resolver cache, undermining DNSSEC integrity guarantees across dependent domains.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
ISC BIND 9 Supported Preview editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-13321 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13321

Vulnerability Analysis

The BIND 9 resolver fails to enforce zone-scope constraints on the Next Domain Name field of NSEC records during DNSSEC validation. NSEC records prove the non-existence of names within a signed zone by pointing to the next existing name in canonical order. The Next Domain Name value must remain within the signer's zone bailiwick. The resolver accepts these records without verifying that the target name falls within the signing zone's authority. An attacker who controls a DNSSEC-signed zone can produce validly-signed NSEC records referencing arbitrary out-of-zone names. The resolver then treats those references as authoritative denial-of-existence proofs for names the attacker does not control. This weakens the trust boundaries DNSSEC is designed to enforce and permits cross-zone assertion injection.

Root Cause

The root cause is missing origin validation on the NSEC Next Domain Name field. The resolver validates the cryptographic signature over the NSEC record but omits the check that the target name is in-bailiwick for the signing zone. This falls under [CWE-346] Origin Validation Error.

Attack Vector

The attack requires an authoritative DNSSEC-signed zone under attacker control and a victim resolver that queries names in that zone. The attacker returns signed NSEC responses where Next Domain Name references a target name outside their zone. The resolver accepts the signature as valid and processes the out-of-bailiwick reference. No authentication or user interaction is required. The vulnerability manifests during standard recursive resolution and DNSSEC validation. See the ISC CVE-2026-13321 Documentation for protocol-level detail.

Detection Methods for CVE-2026-13321

Indicators of Compromise

NSEC records in resolver cache where the Next Domain Name field points to a domain outside the RRSIG signer name
Unexpected NXDOMAIN or NODATA responses for names in zones not associated with the responding authoritative server
Query logs showing DNSSEC-validated denials sourced from zones that should not have authority over the queried name

Detection Strategies

Parse named query and validation logs for NSEC responses and compare the Next Domain Name label against the RRSIG signer field
Correlate resolver cache dumps with expected zone boundaries to identify cross-zone NSEC entries
Deploy passive DNS monitoring to flag NSEC records that assert non-existence for names outside the signer's authority

Monitoring Recommendations

Enable dnssec-validation logging categories in named.conf and forward events to a central log platform
Monitor BIND version strings across resolver fleets to identify hosts still running vulnerable releases
Alert on spikes in DNSSEC validation successes originating from newly registered or low-reputation signed zones

How to Mitigate CVE-2026-13321

Immediate Actions Required

Inventory all BIND 9 resolvers and identify instances running versions in the affected range
Upgrade production resolvers to BIND 9.20.26, 9.21.24, or the equivalent Supported Preview release
Flush resolver caches after patching to remove any cross-zone NSEC entries accepted before the fix

Patch Information

ISC has released fixed versions. Deploy ISC BIND 9.20.26 Release or ISC BIND 9.21.24 Release. Supported Preview customers should apply the corresponding S1 release. Refer to the ISC CVE-2026-13321 Documentation for full remediation guidance.

Workarounds

No configuration workaround eliminates the underlying validation gap; upgrading is the only supported remediation
Restrict recursion to trusted clients using allow-recursion to reduce exposure until patching completes
Where feasible, deploy a validating forwarder from a patched vendor in front of vulnerable resolvers

bash

# Example acl restricting recursion while patching is scheduled
acl "trusted-clients" {
    10.0.0.0/8;
    192.168.0.0/16;
};

options {
    recursion yes;
    allow-recursion { trusted-clients; };
    dnssec-validation auto;
};