DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

[9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field

A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range.

ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue.

Closes isc-projects/bind9#5873

0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch

@@ -1,61 +0,0 @@
-From 31bd3a0996a85c0fced0c6ace3da1241b30dc397 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 30 Apr 2026 17:28:40 +0200
-Subject: [PATCH] Use variable PROGRAM_SUFFIX in install target
-
---program-suffix is handled by configure itself. But some makefile rules
-need to know it by a special value. Provide that to make multiple
-versions installable together on a single system.
----
- Makefile.top            | 1 +
- bin/check/Makefile.am   | 6 +++---
- bin/confgen/Makefile.am | 6 +++---
- 3 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/Makefile.top b/Makefile.top
-index e186d15..91c076b 100644
---- a/Makefile.top
-+++ b/Makefile.top
-@@ -14,6 +14,7 @@ AM_CPPFLAGS =					\
- AM_LDFLAGS =					\
- 	$(STD_LDFLAGS)
- LDADD =
-+PROGRAM_SUFFIX =
- 
- if HOST_MACOS
- AM_LDFLAGS +=					\
-diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am
-index 8f63c35..36f232c 100644
---- a/bin/check/Makefile.am
-+++ b/bin/check/Makefile.am
-@@ -27,8 +27,8 @@ LDADD +=			\
- bin_PROGRAMS = named-checkconf named-checkzone
- 
- install-exec-hook:
--	ln -f $(DESTDIR)$(bindir)/named-checkzone \
--	      $(DESTDIR)$(bindir)/named-compilezone
-+	ln -f $(DESTDIR)$(bindir)/named-checkzone$(PROGRAM_SUFFIX) \
-+	      $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
- 
- uninstall-hook:
--	-rm -f $(DESTDIR)$(bindir)/named-compilezone
-+	-rm -f $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
-diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am
-index c1dca43..fe86dd7 100644
---- a/bin/confgen/Makefile.am
-+++ b/bin/confgen/Makefile.am
-@@ -23,8 +23,8 @@ libconfgen_la_SOURCES =		\
- sbin_PROGRAMS = tsig-keygen rndc-confgen
- 
- install-exec-hook:
--	ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
--	      $(DESTDIR)$(sbindir)/ddns-confgen
-+	ln -f $(DESTDIR)$(sbindir)/tsig-keygen$(PROGRAM_SUFFIX) \
-+	      $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
- 
- uninstall-hook:
--	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen
-+	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
--- 
-2.54.0
-

bind-9.20-tsig-keygen-suffix.patch

@@ -1,45 +0,0 @@
-From 32f203d4e3c711cde5b1546a054be42b16436822 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 17 Jul 2026 19:42:39 +0200
-Subject: [PATCH] Support program suffixes of tsig-confgen and ddns-confgen
-
-Suffixes different than .exe are used on Fedora. But those commands
-require exact names only. Allow switching between two variants only from
-prefix. That should work on all platforms. It should support also names
-like tsig-confgen-9.18 or tsig-confgen-9.20.
-
-The same case applies to named-checkzone and named-compilezone.
----
- bin/check/named-checkzone.c | 2 +-
- bin/confgen/tsig-keygen.c   | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
-index ae8feafc8c..5a1f712463 100644
---- a/bin/check/named-checkzone.c
-+++ b/bin/check/named-checkzone.c
-@@ -137,7 +137,7 @@ main(int argc, char **argv) {
- 	}
- 
- #define PROGCMP(X) \
--	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
-+	(strncasecmp(prog_name, X, strlen(X)) == 0)
- 
- 	if (PROGCMP("named-checkzone")) {
- 		progmode = progmode_check;
-diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
-index f0d2f9a245..9b13312b5b 100644
---- a/bin/confgen/tsig-keygen.c
-+++ b/bin/confgen/tsig-keygen.c
-@@ -113,7 +113,7 @@ main(int argc, char **argv) {
- 	}
- 
- #define PROGCMP(X) \
--	(strcasecmp(progname, X) == 0 || strcasecmp(progname, X ".exe") == 0)
-+	(strncasecmp(progname, X, strlen(X)) == 0)
- 
- 	if (PROGCMP("tsig-keygen")) {
- 		progmode = progmode_keygen;
--- 
-2.54.0
-

named-chroot-setup.service

@@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
-ExecStop=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
+ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
+ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files

named-chroot.service

@@ -12,18 +12,17 @@ After=network.target
 
 [Service]
 Type=forking
-Environment=OPTIONS=
 Environment=NAMEDCONF=/etc/named.conf
 EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/var/named/chroot/run/named/named.pid
 
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_bindir}/named-checkconf%{program_suffix} -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
 
-ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
 
-ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
+ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
 PrivateTmp=false
 Restart=on-abnormal

named-setup-rndc.service

@@ -4,4 +4,4 @@ Description=Generate rndc key for BIND (DNS)
 [Service]
 Type=oneshot
 
-ExecStart=/usr/libexec/%{name}/generate-rndc-key.sh
+ExecStart=/usr/libexec/generate-rndc-key.sh

named.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Berkeley Internet Name Domain (DNS)
+Wants=nss-lookup.target
+Wants=named-setup-rndc.service
+Before=nss-lookup.target
+After=named-setup-rndc.service
+After=network.target
+
+[Service]
+Type=forking
+Environment=NAMEDCONF=/etc/named.conf
+EnvironmentFile=-/etc/sysconfig/named
+Environment=KRB5_KTNAME=/etc/named.keytab
+PIDFile=/run/named/named.pid
+
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+
+ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
+
+PrivateTmp=true
+Restart=on-abnormal
+
+[Install]
+WantedBy=multi-user.target

named.service.in

@@ -1,28 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=named-setup-rndc.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=OPTIONS=
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_sbindir}/named-checkconf%{program_suffix} -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
-
-PrivateTmp=true
-Restart=on-abnormal
-
-[Install]
-WantedBy=multi-user.target