Critical Security Flaw in BIND Package: DNSSEC Validation Bypass and More
Summary
RLSA-2026:54654: Important: bind security update. Affects bind versions < 2:9.11.36-16.el8_10.14. Fixed in 2:9.11.36-16.el8_10.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols, which includes a DNS server (named), a resolver library for applications, and tools for verifying DNS server operations. BIND is crucial for translating human-friendly domain names into IP addresses, making it a foundational component of internet infrastructure. However, it is susceptible to various security vulnerabilities that can compromise its functionality and the integrity of DNS queries.
Vulnerability Detail
This vulnerability affects BIND version 9 and includes multiple security issues. Notably, there is a DNSSEC Validation Bypass due to an out-of-zone NSEC next field (CVE-2026-13321), which could allow attackers to bypass DNSSEC validation. Other issues include potential memory usage beyond configured limits (CVE-2026-11622), cache poisoning via label count discrepancies (CVE-2026-11721), unexpected exits when both NSEC and NSEC3 records are present (CVE-2026-13204), and incorrect acceptance of NSEC3 records (CVE-2026-10723). These vulnerabilities could lead to unauthorized access, data corruption, or denial of service.
How To Fix
Minimum fixed version
2:9.11.36-16.el8_10.14
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable DNSSEC validation in their BIND configuration. This can be done by editing the named.conf file and setting 'dnssec-validation no;' to prevent the server from performing DNSSEC validation until the package is updated. However, this is not recommended as a long-term solution.
Conclusion
The BIND package has critical vulnerabilities that could severely impact DNS operations. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for bind →
FAQ
BIND (Berkeley Internet Name Domain) is a software suite that implements the Domain Name System (DNS) protocols, providing essential services for translating domain names into IP addresses.
The vulnerabilities could lead to cache poisoning, unauthorized access, and potential denial of service, compromising the integrity and availability of DNS services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 8.6, indicating a high severity level that requires immediate attention.
While the best solution is to update to the patched version, you can temporarily disable DNSSEC validation in your BIND configuration as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
