F5-K000163710: Medium severity F5 BIG-IP (DNS) vulnerability
Published Oct 14, 2026
·Updated
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Affected Software
2 affected componentsFixes available
F5 BIG-IP (DNS)=21.1.0
21.1.0.3
F5 BIG-IP (DNS)>=17.5.0<=17.5.1, >=17.1.0<=17.1.3
17.5.1.1017.1.3.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.1.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.1017.1.3.6
Event History
Oct 14, 2026
Advisory Published
via F5·03:42 PM
Data Sourced
via F5·03:42 PM
DescriptionSeverityWeaknessAffected Software