DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)

[9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range. ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue. Closes isc-projects/bind9#5873
Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
2026-08-25 14:51:41 +02:00 · 2026-08-25 14:51:13 +02:00 · 2026-08-25 14:50:47 +02:00 · 2026-08-25 14:50:24 +02:00 · 2026-08-25 14:49:53 +02:00 · 2026-08-25 14:49:18 +02:00
9 changed files with 3384 additions and 3813 deletions
--- a/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
+++ b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
@ -1,61 +0,0 @@
-From 31bd3a0996a85c0fced0c6ace3da1241b30dc397 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 30 Apr 2026 17:28:40 +0200
-Subject: [PATCH] Use variable PROGRAM_SUFFIX in install target
-
--program-suffix is handled by configure itself. But some makefile rules
-need to know it by a special value. Provide that to make multiple
-versions installable together on a single system.
---
- Makefile.top            | 1 +
- bin/check/Makefile.am   | 6 +++---
- bin/confgen/Makefile.am | 6 +++---
- 3 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/Makefile.top b/Makefile.top
-index e186d15..91c076b 100644
--- a/Makefile.top
-+++ b/Makefile.top
-@@ -14,6 +14,7 @@ AM_CPPFLAGS =					\
- AM_LDFLAGS =					\
- 	$(STD_LDFLAGS)
- LDADD =
-+PROGRAM_SUFFIX =
- 
- if HOST_MACOS
- AM_LDFLAGS +=					\
-diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am
-index 8f63c35..36f232c 100644
--- a/bin/check/Makefile.am
-+++ b/bin/check/Makefile.am
-@@ -27,8 +27,8 @@ LDADD +=			\
- bin_PROGRAMS = named-checkconf named-checkzone
- 
- install-exec-hook:
-	ln -f $(DESTDIR)$(bindir)/named-checkzone \
-	      $(DESTDIR)$(bindir)/named-compilezone
-+	ln -f $(DESTDIR)$(bindir)/named-checkzone$(PROGRAM_SUFFIX) \
-+	      $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
- 
- uninstall-hook:
-	-rm -f $(DESTDIR)$(bindir)/named-compilezone
-+	-rm -f $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
-diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am
-index c1dca43..fe86dd7 100644
--- a/bin/confgen/Makefile.am
-+++ b/bin/confgen/Makefile.am
-@@ -23,8 +23,8 @@ libconfgen_la_SOURCES =		\
- sbin_PROGRAMS = tsig-keygen rndc-confgen
- 
- install-exec-hook:
-	ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
-	      $(DESTDIR)$(sbindir)/ddns-confgen
-+	ln -f $(DESTDIR)$(sbindir)/tsig-keygen$(PROGRAM_SUFFIX) \
-+	      $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
- 
- uninstall-hook:
-	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen
-+	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
-- 
-2.54.0
-
--- a/bind-9.20-tsig-keygen-suffix.patch
+++ b/bind-9.20-tsig-keygen-suffix.patch
@ -1,45 +0,0 @@
-From 32f203d4e3c711cde5b1546a054be42b16436822 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Fri, 17 Jul 2026 19:42:39 +0200
-Subject: [PATCH] Support program suffixes of tsig-confgen and ddns-confgen
-
-Suffixes different than .exe are used on Fedora. But those commands
-require exact names only. Allow switching between two variants only from
-prefix. That should work on all platforms. It should support also names
-like tsig-confgen-9.18 or tsig-confgen-9.20.
-
-The same case applies to named-checkzone and named-compilezone.
---
- bin/check/named-checkzone.c | 2 +-
- bin/confgen/tsig-keygen.c   | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
-index ae8feafc8c..5a1f712463 100644
--- a/bin/check/named-checkzone.c
-+++ b/bin/check/named-checkzone.c
-@@ -137,7 +137,7 @@ main(int argc, char **argv) {
- 	}
- 
- #define PROGCMP(X) \
-	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
-+	(strncasecmp(prog_name, X, strlen(X)) == 0)
- 
- 	if (PROGCMP("named-checkzone")) {
- 		progmode = progmode_check;
-diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
-index f0d2f9a245..9b13312b5b 100644
--- a/bin/confgen/tsig-keygen.c
-+++ b/bin/confgen/tsig-keygen.c
-@@ -113,7 +113,7 @@ main(int argc, char **argv) {
- 	}
- 
- #define PROGCMP(X) \
-	(strcasecmp(progname, X) == 0 || strcasecmp(progname, X ".exe") == 0)
-+	(strncasecmp(progname, X, strlen(X)) == 0)
- 
- 	if (PROGCMP("tsig-keygen")) {
- 		progmode = progmode_keygen;
-- 
-2.54.0
-
--- a/bind.spec
+++ b/bind.spec
--- a/3190
+++ b/3190
--- a/named-chroot-setup.service.in
+++ b/named-chroot-setup.service.in
@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
-ExecStop=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
+ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
+ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
--- a/named-chroot.service.in
+++ b/named-chroot.service.in
@ -12,18 +12,17 @@ After=network.target

 [Service]
 Type=forking
-Environment=OPTIONS=
 Environment=NAMEDCONF=/etc/named.conf
 EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/var/named/chroot/run/named/named.pid

-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_bindir}/named-checkconf%{program_suffix} -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS

-ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'

-ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
+ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

 PrivateTmp=false
 Restart=on-abnormal
--- a/named-setup-rndc.service.in
+++ b/named-setup-rndc.service.in
@ -4,4 +4,4 @@ Description=Generate rndc key for BIND (DNS)
 [Service]
 Type=oneshot

-ExecStart=/usr/libexec/%{name}/generate-rndc-key.sh
+ExecStart=/usr/libexec/generate-rndc-key.sh
--- a/named.service
+++ b/named.service
@ -0,0 +1,26 @@
+[Unit]
+Description=Berkeley Internet Name Domain (DNS)
+Wants=nss-lookup.target
+Wants=named-setup-rndc.service
+Before=nss-lookup.target
+After=named-setup-rndc.service
+After=network.target
+
+[Service]
+Type=forking
+Environment=NAMEDCONF=/etc/named.conf
+EnvironmentFile=-/etc/sysconfig/named
+Environment=KRB5_KTNAME=/etc/named.keytab
+PIDFile=/run/named/named.pid
+
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
+ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+
+ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
+
+PrivateTmp=true
+Restart=on-abnormal
+
+[Install]
+WantedBy=multi-user.target
--- a/named.service.in
+++ b/named.service.in
@ -1,28 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=named-setup-rndc.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=OPTIONS=
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_sbindir}/named-checkconf%{program_suffix} -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
-
-PrivateTmp=true
-Restart=on-abnormal
-
-[Install]
-WantedBy=multi-user.target
Author	SHA1	Message	Date
Petr Menšík	a27e5daaca	DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) [9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range. ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue. Closes isc-projects/bind9#5873	2026-08-25 14:51:41 +02:00
Petr Menšík	2dcc28c6bd	Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) [9.18] [CVE-2026-13204] fix: usr: Prevent crash from malformed NSEC/NSEC3 response An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5985	2026-08-25 14:51:13 +02:00
Petr Menšík	ddc9dc2556	Incorrect acceptance of NSEC3 records (CVE-2026-10723) [9.18] [CVE-2026-10723] sec: usr: Correct verification of NSEC3 signer name BIND 9 accepted child-zone NSEC3 records where the first label equals the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. Closes isc-projects/bind9#5874	2026-08-25 14:50:47 +02:00
Petr Menšík	d70148f9c6	Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) [9.18] [CVE-2026-11721] sec: usr: Invalid signed wildcard records were being accepted Signed wildcard responses in which the Labels field in the `RRSIG` record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke `synth-from-dnssec`, which depends on such records being correctly validated. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5871	2026-08-25 14:50:24 +02:00
Petr Menšík	8d9aeabf04	Potential memory usage beyond configured limits (CVE-2026-11622) [9.18] [CVE-2026-11622] sec: usr: Prevent cache exhaustion under sustained attack The cache memory can become exhausted with expired entries whose memory is not released due to a sustained attack on the same DNS name that prevents the cleanup. This has been fixed. Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4760	2026-08-25 14:49:53 +02:00
Petr Menšík	6e476e16fe	Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617) [9.18] [CVE-2026-12617] sec: usr: Do no assert for some specifics CNAME and DNAME queries A bug in the resolver's handling of certain cached DNAME and CNAME responses could cause named to trigger an assertion failure and exit. An attacker controlling a domain name and the authoritative DNS server it is hosted on could exploit this behavior to cause a denial-of-service. This vulnerability has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention. Closes: isc-projects/bind9#5946 [9.18] fix: test: Stabilize the cname_dname_negcache test The test proved unstable due to timing-related race condition, which could produce both false positive and false negative results. Use a more reliable mechanism to reproduce the issue. Human-effort-level: low	2026-08-25 14:49:18 +02:00
Petr Menšík	63d29cf16d	Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822) [9.18] [CVE-2026-10822] sec: usr: Fix dns_name_fromwire to record boundaries Previously, `dns_name_fromwire()` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. This has been fixed. Closes: https://gitlab.isc.org/isc-projects/bind9/-/issues/6004	2026-08-25 14:48:54 +02:00
Petr Menšík	bf9e35b42c	Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) [9.18] [CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure. We now return a YXDOMAIN response, without the address. ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5856	2026-08-25 14:48:29 +02:00
Petr Menšík	ea1c411dcc	Remove /etc/rwtab from the package	2026-06-24 10:59:58 +02:00
Petr Menšík	9db401dfc0	Update to 9.18.50 (rhbz#2489833) Removed Features: - Remove ineffective TCP fallback after repeated UDP timeouts. Feature Changes: - Fall back to TCP on receipt of a UDP response with a mismatched query ID. Bug Fixes: - Fix DNS64 owner case after DNAME restart. - Clear REDIRECT flag when it isn't needed. This should be final release of BIND 9.18 line. That version is now marked EOL. Source: https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/notes.html#notes-for-bind-9-18-50	2026-06-24 10:59:45 +02:00