CVE-2026-11721 Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
Attackers can poison the DNS cache of BIND resolvers by exploiting a label count discrepancy in RRSIGs, leading to incorrect data resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11721?
CVE-2026-11721 is a high-severity vulnerability in ISC BIND 9, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Weakness: CWE-1284
Which versions are affected by CVE-2026-11721?
How do I fix CVE-2026-11721?
Apply the vendor's patch.
Is CVE-2026-11721 being exploited?
There is no known exploitation of CVE-2026-11721 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-11721, AZL-93132, BELL-CVE-2026-11721, DEBIAN-CVE-2026-11721, ECHO-d56a-90b8-201c, GHSA-cq66-h8mj-77hh and 4 more.