CVE-2026-11721: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-11721 is a DNS cache poisoning vulnerability in ISC BIND 9 caused by improper handling of DNSSEC RRSIG label counts. An attacker controlling a DNS zone can respond to queries with an RRSIG record containing fewer labels than the zone it belongs to, causing BIND's named resolver to synthesize an incorrect wildcard name and poison its cache. The vulnerability affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and their corresponding -S1 (Supported) variants. It was disclosed on July 22, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified under CWE-1284 (Improper Validation of Specified Quantity in Input) and CWE-345 (Insufficient Verification of Data Authenticity). When synth-from-dnssec yes; is enabled (the default configuration), BIND's named resolver trusts the label count field in RRSIG records without verifying that it is consistent with the zone depth. An attacker-controlled authoritative zone can return a crafted RRSIG with a label count smaller than the actual zone depth, causing named to construct a wildcard name that is shorter than the attacker's zone — effectively allowing the attacker to inject synthetic DNS responses for domains outside their zone into the resolver's cache. The attack requires no authentication and is exploitable remotely over the network with low complexity (Red Hat Bugzilla, ISC KB).

Successful exploitation allows an unauthenticated network attacker to poison the DNS cache of a vulnerable BIND resolver, causing it to serve incorrect DNS responses to all clients relying on that resolver. This is a high-integrity impact with no direct confidentiality or availability loss to the resolver itself, but poisoned cache entries can redirect users to attacker-controlled infrastructure, enabling phishing, credential theft, man-in-the-middle attacks, and interception of sensitive communications at scale. The scope of impact extends to all clients using the affected resolver, potentially affecting large user populations in enterprise or ISP environments (Red Hat Advisory, GitHub Advisory).

1. Set up a malicious authoritative zone: The attacker registers or controls a DNS zone (e.g., attacker.example.) and operates an authoritative name server for it.
2. Craft a malicious RRSIG response: When the target BIND resolver queries the attacker's zone, the attacker's name server responds with an RRSIG record whose Labels field is set to a value smaller than the actual number of labels in the zone name (e.g., reporting 1 label for a 3-label zone).
3. Trigger wildcard synthesis: Because synth-from-dnssec yes; is enabled on the target resolver, named uses the RRSIG label count to synthesize a wildcard name. The incorrect label count causes named to generate a wildcard that is shorter than the attacker's zone, covering domains the attacker does not legitimately control.
4. Cache poisoning: The synthesized, incorrect DNS record is stored in the resolver's cache, associating attacker-controlled IP addresses with victim domain names.
5. Client misdirection: Clients querying the poisoned resolver for the targeted domain receive the attacker's forged response, redirecting them to attacker-controlled infrastructure for phishing, credential harvesting, or traffic interception (Red Hat Bugzilla, ISC KB).

• Network: Unexpected DNS responses from authoritative servers containing RRSIG records with a Labels field value inconsistent with the zone depth; outbound DNS queries from the resolver returning anomalous wildcard-synthesized records.
• Logs: BIND named query logs showing synthesized wildcard responses (synth-from-dnssec) for domains not directly queried; repeated RRSIG validation events for zones with mismatched label counts in named's security or debug logs.
• DNS Cache: Presence of unexpected wildcard DNS entries in the resolver cache (inspectable via rndc dumpdb -cache) pointing to unfamiliar IP addresses for well-known domains; cache entries for domains that should not have wildcard records.
• Process/Config: synth-from-dnssec yes; present in named.conf on resolvers exposed to untrusted zones (Red Hat Bugzilla, ISC KB).

ISC has released patched versions BIND 9.20.26 and 9.21.24 which address this vulnerability (GitHub Advisory, ISC Downloads). As an immediate workaround, administrators can disable the vulnerable feature by setting synth-from-dnssec no; in named.conf — this prevents the wildcard synthesis behavior that enables the attack, though it disables DNSSEC synthesis functionality. Upgrading to a patched release is the recommended long-term remediation. Administrators should also review DNSSEC response filtering policies to reject RRSIG records with label counts inconsistent with the queried zone (ISC KB, Red Hat Advisory).

The vulnerability was reported to Red Hat's security response team via OSIDB on July 21, 2026, and assigned high severity in Red Hat Bugzilla (Red Hat Bugzilla). A disclosure notice was posted to the oss-security mailing list shortly after public disclosure (oss-sec). Community reaction has been limited at this early stage, with automated CVE tracking services (VulDB, CVEfeed, Vulners) picking up the advisory within hours of publication. No notable independent researcher commentary or significant media coverage has been identified as of the disclosure date.