CVE-2026-13321: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-13321 is a DNSSEC validation bypass vulnerability in ISC BIND 9 where the resolver incorrectly accepts validly-signed NSEC records whose "Next Domain Name" field points outside the signer's zone. This flaw enables cross-zone DNS cache poisoning with the Authenticated Data (AD=1) flag set, allowing an attacker controlling any DNSSEC-signed zone to inject fraudulent DNS records into victim zones. Affected versions include BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding BIND Supported Preview Edition (S1) branches. The vulnerability was disclosed on July 22, 2026, and carries a CVSS v3.1 base score of 8.6 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is an Origin Validation Error (CWE-346): BIND's DNSSEC validation logic fails to enforce that an NSEC record's "Next Domain Name" field must remain within the signing zone's authority. An attacker who controls any legitimately DNSSEC-signed zone can craft NSEC records whose "Next Domain Name" spans into a victim zone, and BIND will accept these records as validly signed. Because the records carry a valid DNSSEC signature, the resolver caches them with the AD (Authenticated Data) flag set, effectively bypassing zone boundary enforcement. No special privileges or user interaction are required — the attack is network-accessible with low complexity (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to poison the DNS cache of a vulnerable BIND resolver with fraudulent records that appear DNSSEC-authenticated (AD=1), effectively undermining the integrity guarantees of DNSSEC. This can redirect users and services relying on the resolver to attacker-controlled servers, enabling phishing, credential harvesting, man-in-the-middle attacks, or interception of sensitive communications. There is no confidentiality or availability impact directly, but the high integrity impact with a changed scope means downstream systems trusting the resolver's DNSSEC validation are also affected (Red Hat Bugzilla, GitHub Advisory).

1. Acquire a DNSSEC-signed zone: The attacker must control or compromise any legitimately DNSSEC-signed DNS zone (e.g., attacker.example.).
2. Craft malicious NSEC records: Create NSEC records within the attacker-controlled zone where the "Next Domain Name" field is set to a name within the victim zone (e.g., victim.com.), spanning zone boundaries.
3. Sign the records: Sign the crafted NSEC records with the attacker zone's valid DNSSEC key, producing legitimately signed but semantically invalid cross-zone NSEC records.
4. Deliver records to the target resolver: Trigger the vulnerable BIND resolver to query the attacker's zone (e.g., via a referral chain or by inducing a lookup), causing it to receive and process the malicious NSEC records.
5. Cache poisoning achieved: The BIND resolver accepts the out-of-zone NSEC records as valid, caches them with AD=1, and uses them to deny or redirect resolution of names in the victim zone, redirecting traffic to attacker-controlled infrastructure (Red Hat Bugzilla, ISC Advisory).

• Logs: BIND query logs showing NSEC records being accepted for names outside the authoritative zone of the signing key; unexpected AD=1 responses for domains that should not be DNSSEC-authenticated.
• Network: DNS responses containing NSEC records where the "Next Domain Name" field belongs to a different zone than the record's owner name; anomalous DNSSEC-signed responses from unexpected authoritative servers.
• DNS Cache: Cached NSEC records spanning zone boundaries (detectable via rndc dumpdb and inspection of the cache dump for cross-zone NSEC entries with AD flag set).
• Process: Unusual BIND resolver behavior such as NXDOMAIN responses with AD=1 for domains known to exist, or unexpected negative caching of valid domain names (Red Hat Bugzilla).

ISC has released patched versions of BIND 9: 9.20.26 and 9.21.24 are available for download and address this vulnerability (GitHub Advisory). Administrators should upgrade to these fixed versions as the primary remediation. As interim mitigations, restrict DNS resolver access to trusted internal networks only, and monitor BIND logs for anomalous NSEC record processing. Implementing additional DNS security controls and hardening DNSSEC validation on downstream services can reduce exposure until patching is complete (Red Hat Advisory, ISC Advisory).

The vulnerability was reported to Red Hat's security response team via OSIDB on July 21, 2026, and publicly disclosed the following day. Red Hat has classified it as high severity and opened a tracking bug. The ISC published an official knowledge base article detailing the issue. Community aggregators including OSS-Sec, VulDB, and security intelligence platforms picked up the disclosure within hours of publication, indicating broad awareness in the DNS and security community (Red Hat Bugzilla, ISC Advisory).