CVE-2026-80274: Validating resolver can abort while caching a mismatched NOQNAME proof
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.26 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are BIND 9 resolvers running versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1. The issue is in resolver behavior when handling responses from DNSSEC-signed authoritative zones.
What response pattern triggers the failure?
The resolver must query a DNSSEC-signed authoritative zone and receive a valid wildcard answer with a signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. Processing that combination can cause an unexpected program exit.
What is the practical impact of successful exploitation?
The reported impact is an unexpected program exit in the BIND resolver, resulting in an availability impact. The provided severity vector indicates the issue is remotely reachable, requires no privileges or user interaction, and does not report confidentiality or integrity impact.