CVE-2026-11721— Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
Possible ATT&CK Techniques 2AI
T1498.002 · Reflection Amplification T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11721
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
Source: CVE Program / CVE List V5
Vulnerability Description
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default). This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-11721
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11721
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11721 (2)
Vendor Pages for CVE-2026-11721 (1)
Same Patch Batch · ISC · 2026-07-22 · 9 CVEs total
| CVE-2026-13321 | 8.6 HIGH | DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field |
| CVE-2026-11605 | 7.5 HIGH | Unnecessary validation of DNSSEC signed records |
| CVE-2026-11331 | 7.5 HIGH | Potential wildcard CNAME RPZ policy bypass |
| CVE-2026-11622 | 7.5 HIGH | Potential memory usage beyond configured limits |
| CVE-2026-12617 | 7.5 HIGH | Record ordering based unexpected exit with CNAME or DNAME |
| CVE-2026-13204 | 7.5 HIGH | Unexpected exit in certain situations with NSEC and NSEC3 both present |
| CVE-2026-10723 | 6.8 MEDIUM | Incorrect acceptance of NSEC3 records |
| CVE-2026-10822 | 6.5 MEDIUM | Key Record using PRIVATEDNS algorithm may lead to unexpected exit |
IV. Related Vulnerabilities
Same product: BIND 9
- CVE-2026-13321
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field - CVE-2026-13204
Unexpected exit in certain situations with NSEC and NSEC3 bo - CVE-2026-12617
Record ordering based unexpected exit with CNAME or DNAME - CVE-2026-11622
Potential memory usage beyond configured limits - CVE-2026-11605
Unnecessary validation of DNSSEC signed records
Same vendor: ISC
- CVE-2026-13321
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field - CVE-2026-13204
Unexpected exit in certain situations with NSEC and NSEC3 bo - CVE-2026-12617
Record ordering based unexpected exit with CNAME or DNAME - CVE-2026-11622
Potential memory usage beyond configured limits - CVE-2026-11605
Unnecessary validation of DNSSEC signed records
Same weakness: CWE-1284
- CVE-2026-32665
Remote DNS-over-QUIC denial of service due to `quic-size` bu - CVE-2026-59252
Missing gas_limit validation in mpp Tempo fee-payer enables - CVE-2026-59694
Unbounded access list in mpp Tempo fee-payer inflates gas co - CVE-2026-59695
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables sin - CVE-2026-57364
WordPress Better Payment – Instant Payments, Donations, Fund
V. Comments for CVE-2026-11721
No comments yet