CVE-2026-11331 in BIND 9
Summary
by MITRE • 07/22/2026
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical flaw in the BIND 9 recursive name server implementation that exploits the handling of Resource Policy Zone (RPZ) wildcard CNAME policies during DNS query processing. The issue stems from insufficient validation of query name lengths when RPZ rules are applied, particularly when wildcard patterns are involved in the policy enforcement mechanism. Attackers can exploit this by crafting specially formatted domain names that exceed the maximum allowed length during RPZ processing, triggering a NAMETOOLONG error condition that the software does not handle gracefully.
The technical execution involves understanding how BIND 9 processes RPZ policies when wildcard CNAME entries are present in the zone data structure. When a resolver encounters a query that matches a wildcard pattern in an RPZ zone, it attempts to construct a response based on the policy configuration. However, the current implementation fails to properly validate or truncate excessively long domain names during this processing phase, leading to an unhandled error condition that can result in software termination or policy bypass.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable sophisticated attack vectors. When the BIND 9 process exits unexpectedly due to the NAMETOOLONG error, it creates a denial-of-service condition that can be exploited by malicious actors to disrupt DNS resolution services. Additionally, the bypass mechanism allows attackers to circumvent intended RPZ protections, potentially enabling access to blocked domains or malicious resources that should have been filtered by the policy enforcement system.
This vulnerability maps directly to CWE-129 and CWE-770 in the Common Weakness Enumeration catalog, representing improper input validation and insufficient error handling respectively. The issue also aligns with ATT&CK technique T1562.001 (Impair Defenses: Disable or Modify Tools) as it can be used to disable security controls through service disruption, and T1071.004 (Application Layer Protocol: DNS) as it exploits fundamental DNS protocol processing mechanisms. The vulnerability affects multiple release branches of BIND 9, indicating a systemic issue in the software's error handling architecture rather than a localized bug.
Organizations should immediately implement mitigations including updating to patched versions of BIND 9 that properly handle long domain names during RPZ processing, implementing rate limiting on suspicious query patterns, and monitoring for unexpected process exits or service disruptions. Network administrators should also consider deploying additional DNS security measures such as DNS firewall rules to prevent exploitation attempts and ensure proper logging of RPZ-related events for threat detection purposes. The vulnerability demonstrates the critical importance of proper input validation in DNS servers where malformed queries can lead to complete service failure rather than simple query rejection.