Loading story…
Internet Systems Consortium disclosed nine vulnerabilities in BIND 9 and released patched versions 9.20.26 and 9.21.24. The most severe issue, CVE-2026-13321 (CVSS 8.6), allows a remotely exploitable DNSSEC validation bypass by accepting signed NSEC records whose Next Domain Name points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed CVE-2026-11721, a high-severity cache poisoning flaw tied to label-count discrepancies in RRSIG and wildcard synthesis, and CVE-2026-10723, which can let attackers forge authenticated NXDOMAIN responses for sibling zones through incorrect acceptance of child-zone NSEC3 records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases.
The remaining flaws include several remotely exploitable denial-of-service and resource exhaustion bugs affecting DNSSEC-validating resolvers and other BIND components. CVE-2026-11622 can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while CVE-2026-11605 can force excessive CPU use by making BIND validate unnecessary but valid RRSIG records. CVE-2026-13204, CVE-2026-12617, and CVE-2026-10822 can cause named to exit unexpectedly under specific malformed or specially ordered DNS responses, and CVE-2026-11331 can bypass wildcard RPZ CNAME policies and also trigger a crash with overly long query names. ISC advised users of affected 9.11, 9.18, 9.20, 9.21, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-22, ISC released updated BIND 9 versions 9.20.26 and 9.21.24 to address the disclosed vulnerabilities. The oss-sec posting said the embargo ended with the disclosure, allowing prepared packages to be released publicly.
On 2026-07-22, ISC publicly disclosed nine vulnerabilities affecting BIND 9, spanning cache poisoning, DNSSEC validation bypass, denial of service, RPZ policy bypass, and resource exhaustion issues. ISC stated no active exploitation was known at disclosure time and advised users to upgrade.
ISC said CVE-2026-10822, a malformed PRIVATEDNS KEY/DNSKEY record issue that can make BIND abort, was identified during internal testing.
ISC said CVE-2026-11622, which can drive resolver memory usage far beyond configured limits under a random subdomain attack, was discovered during internal testing.
ISC credited Laith Mash'al (0xmshal) with reporting CVE-2026-11331, a flaw that can bypass wildcard CNAME RPZ policy rules and may also cause BIND 9 to exit unexpectedly.
ISC said CVE-2026-13204, a denial-of-service flaw involving mixed NSEC and NSEC3 validation states, was reported to the company by Qifan Zhang of Palo Alto Networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
19 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcekb.isc.org
Open sourcesecurity-tracker.debian.org
Open sourcedownloads.isc.org
Open sourcedownloads.isc.org
Open sourcekb.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium (ISC) disclosed four vulnerabilities in **BIND 9** affecting supported releases and Supported Preview Edition builds, including `CVE-2026-1519`, `CVE-2026-3104`, `CVE-2026-3119`, and `CVE-2026-3591`. The flaws impact DNSSEC validation and proof generation, authenticated queries containing `TKEY` records, and `SIG(0)` handling. Reported consequences include excessive CPU consumption during insecure delegation validation, a memory leak while preparing DNSSEC proofs, unexpected termination of the `named` daemon, and a stack use-after-return condition that could allow an ACL bypass. Affected branches include **BIND 9.11, 9.18, 9.20, and 9.21** across specified version ranges, and ISC said the public disclosure ended the embargo period so prepared packages could be released. Patched versions were issued as **9.18.47**, **9.20.21**, and **9.21.20**, and the Canadian Centre for Cyber Security urged administrators to review ISC’s advisories and apply the required updates.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026
ISC released security advisories addressing several high-severity vulnerabilities in *BIND 9* DNS software, affecting versions 9.11.x, 9.16.x, 9.18.x, 9.20.x, and 9.21.x. These flaws could allow attackers to conduct cache poisoning and denial of service (DoS) attacks, potentially disrupting DNS resolution and compromising the integrity of DNS responses. The vulnerabilities are tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, and have been rated as critical due to their potential impact on DNS infrastructure. Administrators are strongly advised to review the official advisories and apply the necessary patches to affected BIND 9 deployments. The Canadian Centre for Cyber Security and other security organizations have issued alerts urging immediate action to mitigate the risk of exploitation. Failure to update could expose organizations to significant operational and security risks, including service outages and the possibility of malicious redirection of network traffic.
Jun 29, 2026