cve-2026-11721

{
  "cvss": 7.5,
  "datePublished": "2026-07-22T15:16:51.837",
  "dateUpdated": "2026-11-02T17:40:42.150",
  "description": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default).\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
  "id": "CVE-2026-11721",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "BIND 9",
            "vendor": "ISC",
            "versions": [
              {
                "lessThanOrEqual": "9.18.50",
                "status": "affected",
                "version": "9.11.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24",
                "status": "affected",
                "version": "9.20.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.21.23",
                "status": "affected",
                "version": "9.21.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.18.50-S1",
                "status": "affected",
                "version": "9.11.3-S1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24-S1",
                "status": "affected",
                "version": "9.20.9-S1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security-officer@isc.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0BD9C8C0-B51C-4826-9A67-560E5B3F1C24",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.11.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "22CF447E-BD05-4B2D-B570-7C138D2C2A7C",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.11.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "080D7F98-9784-4586-8ADA-CAAA0A9EC180",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "AA853047-029C-4BC6-9C8C-10B183B9FB9E",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "769711AE-516A-4D05-997D-55E3DEF5697B",
                "versionEndIncluding": "9.21.23",
                "versionStartIncluding": "9.21.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default).\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."
      },
      {
        "lang": "es",
        "value": "Es posible que la zona de un atacante responda a una consulta con un RRSIG que tiene un número menor de etiquetas que la zona en la que está contenido el RRSIG. Esto hace que “named” produzca un nombre comodín para una zona que es más corta que la zona del atacante, lo que puede resultar en envenenamiento de caché. Para que este ataque tenga algún efecto, el resolvedor bajo ataque debe haber configurado “synth-from-dnssec yes;” (que es el valor predeterminado).\nEste problema afecta a las versiones de BIND 9 9.11.0 a 9.18.50, 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, 9.11.3-S1 a 9.18.50-S1, y 9.20.9-S1 a 9.20.24-S1."
      }
    ],
    "id": "CVE-2026-11721",
    "lastModified": "2026-11-02T17:40:42.150",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-officer@isc.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-11721",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-22T18:52:35.390125Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-22T15:16:51.837",
    "references": [
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.20.26"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.21.24"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://kb.isc.org/docs/cve-2026-11721"
      }
    ],
    "sourceIdentifier": "security-officer@isc.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-1284"
          }
        ],
        "source": "security-officer@isc.org",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than th..."
}