PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11331 ISC CVE debrief

CVE-2026-11331 is a vulnerability in BIND 9's Response Policy Zone (RPZ) processing. An attacker who knows or guesses that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. The vulnerability allows an attacker to potentially defeat RPZ rules or cause the BIND 9 software to exit unexpectedly.

Vendor
ISC
Product
BIND 9
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Organizations using BIND 9 with RPZ and wildcard CNAME policies should assess their vulnerability and apply patches or mitigations. This includes reviewing and updating RPZ configurations, monitoring BIND 9 logs for unusual query patterns or error conditions, and considering additional security controls such as query rate limiting or IP blocking.

Technical summary

The vulnerability allows an attacker to craft query names that trigger a NAMETOOLONG error during RPZ processing, potentially defeating RPZ rules or causing the BIND 9 software to exit unexpectedly. Affected versions include BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. The issue arises when an attacker knows or guesses that a resolver uses RPZ with wildcard CNAME policies and crafts query names long enough to trigger a NAMETOOLONG error condition during RPZ processing.

Defensive priority

High

Recommended defensive actions

  • Inventory BIND 9 installations and versions to identify potentially vulnerable configurations.
  • Apply patches or updates to affected BIND 9 versions.
  • Review and update RPZ configurations to reduce the risk of exploitation.
  • Monitor BIND 9 logs for unusual query patterns or error conditions.
  • Consider implementing additional security controls, such as query rate limiting or IP blocking.

Evidence notes

The CVE record was published on 2026-07-22T15:16:51.457Z and was last modified on 2026-07-22T20:33:11.590Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11331 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11331

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11331 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11331

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.