Description

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-22T15:16:51.837Z",
  "pubdate": "2026-07-22T15:16:51.837Z",
  "executiveSummary": "This vulnerability is a cache poisoning flaw affecting the BIND 9 Domain Name System (DNS) server software, specifically within its DNSSEC validation and synthesis mechanisms.\nThe flaw allows an attacker controlling a malicious authoritative zone to craft responses containing specially manipulated RRSIG (Resource Record Signature) records that feature a smaller label count than the containing zone.\nWhen processed by a vulnerable resolver, this discrepancy causes the named daemon to generate an improper wildcard name for a zone that is artificially shorter than the attacker's zone.\nIf the target resolver has the configuration directive synth-from-dnssec set to yes, which is enabled by default, this malformed synthesis results in successful cache poisoning.\nThe impact of successful exploitation includes the corruption of the resolver's cache, potentially redirecting legitimate client traffic to malicious destinations for arbitrary domains.\nAffected systems comprise multiple BIND 9 branches, including versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, as well as associated supported preview editions (9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1).\nExploitation requires the attacker to control a rogue authoritative nameserver and necessitates that the victim resolver has the default DNSSEC synthesis configuration active.",
  "technicalDetails": "The root cause of this vulnerability lies in how the named component processes and validates RRSIG resource records against the labels of the originating zone.\nUnder normal DNSSEC operations, an RRSIG record corresponds to the owner name and label depth of the zone in which it resides.\nThe vulnerability is triggered when an attacker's authoritative zone responds to a legitimate or attacker-induced query with an RRSIG containing a label count smaller than the actual zone depth.\nThe named component fails to adequately validate the structural integrity and label boundaries of the returned RRSIG relative to the expected zone context.\nConsequently, the resolver synthesizes a wildcard name for a zone that is shorter than the attacker's actual zone.\nThis miscalculation misleads the resolver into accepting and caching forged resource records for domains outside the attacker's authorized delegation path.\nThe exploitation prerequisites dictate that the targeted resolver must have the synth-from-dnssec configuration option enabled, which is the default setting across the affected BIND 9 versions.\nThe attack flow proceeds as follows: First, the attacker configures a malicious authoritative nameserver to host a rogue zone. Second, the attacker induces the victim BIND 9 resolver to query this zone, or waits for a natural user query to trigger the interaction. Third, the attacker's nameserver responds with a maliciously crafted RRSIG record featuring a reduced label count. Fourth, the named process parses the response, improperly calculates the wildcard name based on the manipulated RRSIG, and bypasses standard zone boundary checks due to the active synth-from-dnssec feature. Fifth, the resolver inserts the forged records into its cache as authentic data.\nThe vulnerable component is the named daemon within the BIND 9 software suite, specifically the DNSSEC response synthesis and caching subsystems.\nAffected software versions include 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.\nThe attack does not require authentication or elevated privileges against the resolver itself, but relies entirely on network exposure where the resolver accepts recursive queries and interacts with external authoritative nameservers over the standard UDP or TCP port 53 protocols."
}