ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw
Do Son 
- Total: 9 CVEs
- Severity: 7 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 8.6 (High · CVSSv3) — CVE-2026-13321
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS | Type | Status |
|---|---|---|---|
| CVE-2026-13321 | 8.6 | CWE-346 | Not exploited |
| CVE-2026-11331 | 7.5 | CWE-790 | Not exploited |
| CVE-2026-11605 | 7.5 | CWE-408 | Not exploited |
| CVE-2026-11622 | 7.5 | CWE-770 | Not exploited |
| CVE-2026-11721 | 7.5 | CWE-1284 | Not exploited |
| CVE-2026-12617 | 7.5 | CWE-617 | Not exploited |
| CVE-2026-13204 | 7.5 | CWE-617 | Not exploited |
| CVE-2026-10723 | 6.8 | CWE-347 | Not exploited |
TL;DR
ISC released BIND 9.20.26 and 9.21.24 on July 22, 2026. The updates fix nine flaws in the widely used DNS server. The most serious BIND vulnerability, CVE-2026-13321, enables cross-zone cache poisoning and scores 8.6.
Why it matters
BIND is one of the most deployed DNS servers on the internet. A cache poisoning flaw there can redirect users to attacker-controlled answers. Every flaw in this batch is remotely exploitable.
Most bugs affect DNSSEC validation, the very layer meant to guarantee trust. That makes this BIND vulnerability set a priority for any resolver operator.
The top flaw: CVE-2026-13321
CVE-2026-13321 rates 8.6, the highest in the group. The resolver accepts signed NSEC records whose “Next Domain Name” points outside the signer’s zone. As a result, an attacker who controls one signed zone can forge authenticated denial responses for a victim zone.
How the attacks work
The nine issues split into three groups. First come the spoofing and poisoning bugs. Besides CVE-2026-13321, CVE-2026-11721 abuses a label-count mismatch to poison the cache, and CVE-2026-10723 lets an attacker forge NXDOMAIN answers.
Next come the denial-of-service crashes. CVE-2026-12617, CVE-2026-13204, and CVE-2026-10822 can each make named exit unexpectedly. Malformed records or specific query orderings trigger the assertion failures.
Last come the resource-exhaustion flaws. CVE-2026-11605 wastes CPU on needless signature checks. CVE-2026-11622 drives memory far past configured limits during a random-subdomain attack. Separately, CVE-2026-11331 can bypass an RPZ rule.
Affected versions
The flaws span the 9.18, 9.20 and 9.21 branches. Coverage varies by CVE. In broad terms, they hit 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, and 9.21.0 through 9.21.23. Supported Preview Edition builds are affected too.
Exploitation status
No in-the-wild exploitation has been confirmed for any of these CVEs. ISC also reports no public proof-of-concept code. Still, the DNSSEC bypass and cache poisoning risks warrant fast action.
Patch and mitigation
Upgrade to a fixed release without delay. Stable users should move to BIND 9.20.26, the production-ready branch. Testing users can pull BIND 9.21.24, which ISC marks as a development release.
No workaround exists for most of these issues, so patching is the real fix. After upgrading, restart named to load the new build.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
