USN-8648-1: Bind vulnerabilities

unknownCVE-2026-10723 CVE-2026-10822 CVE-2026-11331 CVE-2026-11605 CVE-2026-11622 CVE-2026-11721

It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. (CVE-2026-10723) It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-10822) It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. (CVE-2026-11331) It was discovered that Bind performed unnecessary validation of DNSSEC signed records. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-11605) It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. (CVE-2026-11622) It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. (CVE-2026-11721) It was discovered that Bind incorrectly handled certain CNAME and DNAME record orderings in the resolver. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-12617) It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. (CVE-2026-13321)

CSIRTS triage

vendor: Bind product: Bind Authentication bypass Denial of service Information disclosure

What: Incorrect NSEC3 validation enables DNSSEC bypass, improper PRIVATEDNS algorithm handling causes denial of service, wildcard CNAME expansion bypass in RPZ, and unnecessary DNSSEC validation exhausts resources.
Who is affected: Bind DNS servers running affected versions on systems with DNSSEC, RPZ policies, or PRIVATEDNS configurations.
Urgency: Moderate priority; affects DNS security and availability but not yet exploited.
Action: Apply security patches for Bind as provided in USN-8648-1.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Bind

Get an email when a new Bind advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8648-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-107230.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-108220.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-113310.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-116050.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-116220.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-117210.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-126170.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-133210.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-10723	coverage & exploitation status	NVD · CVE.org
CVE-2026-10822	coverage & exploitation status	NVD · CVE.org
CVE-2026-11331	coverage & exploitation status	NVD · CVE.org
CVE-2026-11605	coverage & exploitation status	NVD · CVE.org
CVE-2026-11622	coverage & exploitation status	NVD · CVE.org
CVE-2026-11721	coverage & exploitation status	NVD · CVE.org
CVE-2026-12617	coverage & exploitation status	NVD · CVE.org
CVE-2026-13321	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.