BIND 9.11-9.21 NSEC "Next Domain" DNS Zone Validation Flaw
CVE-2026-13321 Published on July 22, 2026

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-13321 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.


Products Associated with CVE-2026-13321

Want to know whenever a new CVE is published for ISC BIND? stack.watch will email you.

ISC BIND
 

Affected Versions

ISC BIND 9: