DSA-6395-1 bind9 - security update
Several vulnerabilities were discovered in BIND, a DNS server implementation, which may result in bypass of DNSSEC validation, RPZ policy bypass, cache poisoning or denial of service. https://security-tracker.debian.org/tracker/DSA-6395-1
CSIRTS triage
- What
- Several vulnerabilities in BIND may lead to DNSSEC validation bypass, cache poisoning, and denial of service.
- Who is affected
- Deployments of BIND DNS server.
- Urgency
- Remediation is necessary to prevent potential exploitation and service disruption.
- Action
- Update to the latest version of BIND to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch BIND
Get an email when a new BIND advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00306.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-107230.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all scored CVEs.
- Low exploitation riskCVE-2026-108220.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
- Low exploitation riskCVE-2026-113310.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all scored CVEs.
- Low exploitation riskCVE-2026-116050.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.
- Low exploitation riskCVE-2026-116220.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
- Low exploitation riskCVE-2026-117210.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
- Low exploitation riskCVE-2026-126170.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
- Low exploitation riskCVE-2026-132040.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
- Low exploitation riskCVE-2026-133210.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-10723 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-10822 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11331 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11605 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11622 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11721 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-12617 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13204 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13321 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Internet Systems Consortium BIND: Multiple vulnerabilitiescert-bund
- highCVE-2026-13321: The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field point…nvd
- highCVE-2026-13204: If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and t…nvd
- highCVE-2026-12617: The issue is unexpected program termination based on ordering and/or specific content in respo…nvd
- highCVE-2026-11721: It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller n…nvd
- highCVE-2026-11622: A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed z…nvd
- highCVE-2026-11605: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND alway…nvd
- highCVE-2026-11331: An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can c…nvd
- mediumCVE-2026-10822: If BIND encounters a particular invalid data structure in a DNS record, it will accept the inv…nvd
- mediumCVE-2026-10723: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to …nvd
- highCVE-2026-11331: Potential wildcard CNAME RPZ policy bypassmsrc
- mediumCVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exitmsrc
More from Debian Security Advisories
- unknownDSA-6409-1 libgd2 - security update2026-08-01
- unknownDSA-6408-1 chromium - security update2026-07-31
- unknownDSA-6406-1 php8.4 - security update2026-07-31
- unknownDSA-6405-1 linux - security update2026-07-31
- unknownDSA-6407-1 incus - security update2026-07-31