CVE-2026-11721

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1

Description An attacker can respond to a query with an RRSIG containing fewer labels than the zone in which the RRSIG is located. This causes named to generate a wildcard name for a zone shorter than the attacker's zone, potentially leading to cache poisoning. This issue occurs when the resolver has the synth-from-dnssec variable set to yes, which is the default configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Set the synth-from-dnssec variable to no to mitigate the risk of exploitation.