cve-2026-11331

{
  "cvss": 7.5,
  "datePublished": "2026-07-22T15:16:51.457",
  "dateUpdated": "2026-11-02T17:45:23.230",
  "description": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
  "id": "CVE-2026-11331",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "BIND 9",
            "vendor": "ISC",
            "versions": [
              {
                "lessThanOrEqual": "9.18.50",
                "status": "affected",
                "version": "9.16.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24",
                "status": "affected",
                "version": "9.20.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.21.23",
                "status": "affected",
                "version": "9.21.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.18.50-S1",
                "status": "affected",
                "version": "9.16.8-S1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24-S1",
                "status": "affected",
                "version": "9.20.9-S1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security-officer@isc.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "2D4F1AF4-8774-4461-93A8-BC94C73D53AB",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.16.8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "F311703A-5945-4295-A036-5D878F136343",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.18.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "080D7F98-9784-4586-8ADA-CAAA0A9EC180",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "AA853047-029C-4BC6-9C8C-10B183B9FB9E",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "769711AE-516A-4D05-997D-55E3DEF5697B",
                "versionEndIncluding": "9.21.23",
                "versionStartIncluding": "9.21.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."
      },
      {
        "lang": "es",
        "value": "Un atacante que sabe (o adivina) que un resolvedor usa RPZ con políticas CNAME de comodín puede elaborar nombres de consulta lo suficientemente largos como para activar una condición de error NAMETOOLONG durante el procesamiento de RPZ. Esto no se maneja correctamente y puede llevar a eludir la regla RPZ. También puede llevar a una salida inesperada del software BIND 9.\nEste problema afecta a las versiones de BIND 9 9.16.0 hasta 9.18.50, 9.20.0 hasta 9.20.24, 9.21.0 hasta 9.21.23, 9.16.8-S1 hasta 9.18.50-S1, y 9.20.9-S1 hasta 9.20.24-S1."
      }
    ],
    "id": "CVE-2026-11331",
    "lastModified": "2026-11-02T17:45:23.230",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-officer@isc.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-11331",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-22T18:54:08.280433Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-22T15:16:51.457",
    "references": [
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.20.26"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.21.24"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://kb.isc.org/docs/cve-2026-11331"
      }
    ],
    "sourceIdentifier": "security-officer@isc.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-790"
          }
        ],
        "source": "security-officer@isc.org",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long e..."
}