This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-11721 →

DEBIAN-CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is cont...

Original description

The description as published by the source.

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 bind9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.49-1~deb12u2"}]}]

Debian:13 bind9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.26-1~deb13u1"}]}]

Debian:14 bind9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.26-1"}]}]

References

advisory security-tracker.debian.org