CVE-2026-13204 Unexpected exit in certain situations with NSEC and NSEC3 both present
An attacker can cause a denial of service in BIND by triggering an assertion failure when validating domains with mixed NSEC and NSEC3 records.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13204?
CVE-2026-13204 is a high-severity denial of service vulnerability in ISC BIND 9, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Weakness: CWE-617
Which versions are affected by CVE-2026-13204?
How do I fix CVE-2026-13204?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-13204 being exploited?
There is no known exploitation of CVE-2026-13204 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-13204, AZL-93117, BELL-CVE-2026-13204, CLSA-2026-1785267075, CLSA-2026-1785309449, CLSA-2026-1785309455 and 9 more.