USN-8648-1: Bind vulnerabilities
It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331) It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622) It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721) It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617) It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)
CSIRTS triage
- What
- Incorrect NSEC3 validation enables DNSSEC bypass, improper PRIVATEDNS algorithm handling causes denial of service, wildcard CNAME expansion bypass in RPZ, and unnecessary DNSSEC validation exhausts resources.
- Who is affected
- Bind DNS servers running affected versions on systems with DNSSEC, RPZ policies, or PRIVATEDNS configurations.
- Urgency
- Moderate priority; affects DNS security and availability but not yet exploited.
- Action
- Apply security patches for Bind as provided in USN-8648-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Bind
Get an email when a new Bind advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8648-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-107230.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-108220.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-113310.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-116050.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-116220.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-117210.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-126170.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-133210.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-10723 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-10822 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11331 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11605 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11622 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-11721 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-12617 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13321 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Internet Systems Consortium BIND: Multiple vulnerabilitiescert-bund
- high[NEW] [high] Meinberg LANTIME: Multiple vulnerabilitiescert-bund
- highCVE-2026-13321: The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field point…nvd
- highCVE-2026-12617: The issue is unexpected program termination based on ordering and/or specific content in respo…nvd
- highCVE-2026-11721: It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller n…nvd
- highCVE-2026-11622: A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed z…nvd
- highCVE-2026-11605: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND alway…nvd
- highCVE-2026-11331: An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can c…nvd
- mediumCVE-2026-10822: If BIND encounters a particular invalid data structure in a DNS record, it will accept the inv…nvd
- mediumCVE-2026-10723: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to …nvd
- unknownDSA-6395-1 bind9 - security updatedebian
- highCVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAMEmsrc
More from Ubuntu Security Notices
- unknownUSN-8724-1: rabbitmq-c vulnerabilities2026-09-03
- unknownUSN-8720-1: GnuPG vulnerability2026-09-03
- unknownUSN-8723-1: SPICE vdagent vulnerabilities2026-09-03
- unknownUSN-8722-1: libssh2 vulnerabilities2026-09-03
- unknownUSN-8719-1: APR-util vulnerabilities2026-09-03