{"cvss":6.8,"datePublished":"2026-07-22T15:16:51.190","dateUpdated":"2026-11-02T17:48:44.730","description":"BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.","id":"CVE-2026-10723","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BIND 9","vendor":"ISC","versions":[{"lessThanOrEqual":"9.18.50","status":"affected","version":"9.18.0","versionType":"custom"},{"lessThanOrEqual":"9.20.24","status":"affected","version":"9.20.0","versionType":"custom"},{"lessThanOrEqual":"9.21.23","status":"affected","version":"9.21.0","versionType":"custom"},{"lessThanOrEqual":"9.18.50-S1","status":"affected","version":"9.11.3-S1","versionType":"custom"},{"lessThanOrEqual":"9.20.24-S1","status":"affected","version":"9.20.9-S1","versionType":"custom"}]}],"source":"security-officer@isc.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*","matchCriteriaId":"22CF447E-BD05-4B2D-B570-7C138D2C2A7C","versionEndIncluding":"9.18.50","versionStartIncluding":"9.11.3","vulnerable":true},{"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*","matchCriteriaId":"F311703A-5945-4295-A036-5D878F136343","versionEndIncluding":"9.18.50","versionStartIncluding":"9.18.0","vulnerable":true},{"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*","matchCriteriaId":"080D7F98-9784-4586-8ADA-CAAA0A9EC180","versionEndIncluding":"9.20.24","versionStartIncluding":"9.20.0","vulnerable":true},{"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*","matchCriteriaId":"AA853047-029C-4BC6-9C8C-10B183B9FB9E","versionEndIncluding":"9.20.24","versionStartIncluding":"9.20.9","vulnerable":true},{"criteria":"cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*","matchCriteriaId":"769711AE-516A-4D05-997D-55E3DEF5697B","versionEndIncluding":"9.21.23","versionStartIncluding":"9.21.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."},{"lang":"es","value":"BIND puede aceptar registros NSEC3 de zona hija incorrectos como válidos, lo que podría permitir a un atacante falsificar respuestas NXDOMAIN autenticadas.\nEste problema afecta a las versiones de BIND 9 9.18.0 a la 9.18.50, 9.20.0 a la 9.20.24, 9.21.0 a la 9.21.23, 9.11.3-S1 a la 9.18.50-S1, y 9.20.9-S1 a la 9.20.24-S1."}],"id":"CVE-2026-10723","lastModified":"2026-11-02T17:48:44.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.0,"source":"security-officer@isc.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-22T18:47:20.644848Z","version":"2.0.3"}}]},"published":"2026-07-22T15:16:51.190","references":[{"source":"security-officer@isc.org","tags":["Product"],"url":"https://downloads.isc.org/isc/bind9/9.20.26"},{"source":"security-officer@isc.org","tags":["Product"],"url":"https://downloads.isc.org/isc/bind9/9.21.24"},{"source":"security-officer@isc.org","tags":["Vendor Advisory"],"url":"https://kb.isc.org/docs/cve-2026-10723"}],"sourceIdentifier":"security-officer@isc.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security-officer@isc.org","type":"Secondary"}]},"severity":"MEDIUM","source":"nvd","title":"BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXD..."}