The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the…

BIND's validator was supposed to enforce that an NSEC record's *Next Domain Name* field stays inside the zone that signed it — that's the whole point of the authenticated-denial chain in DNSSEC. This bug means a validly-signed NSEC from attacker.tld can name-range across into victim.tld, and BIND will accept the AD=1 (authenticated denial) answer as gospel. Anyone who can register a DNSSEC-signed zone (i.e., anyone with $10 and a registrar account) can inject authenticated non-existence proofs for arbitrary names in other people's zones, poisoning the resolver cache with a cryptographically blessed lie. Affected: BIND 9.11.0–9.18.50, 9.20.0–9.20.24, 9.21.0–9.21.23, plus the -S1 Supported Preview branches through 9.20.24-S1.

ISC rated this HIGH (8.6) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The vector is right — network reachable, no auth, scope-changed, integrity-only — but the HIGH label undersells the deployment context. BIND 9 is *the* resolver that ships with every RHEL/Debian/Ubuntu box and runs on a huge share of enterprise and ISP recursive resolvers. A cache-poisoning primitive against the recursive tier is not a per-host bug; one poisoned cache lies to every downstream client. We upgrade to CRITICAL on role multiplier and blast radius, not on friction.

Why this verdict

• Role multiplier — recursive resolver tier: BIND 9 with dnssec-validation is a canonical high-value component. A single poisoned cache serves an entire enterprise or ISP subscriber base; chain outcome is fleet-scale integrity failure. Floor: CRITICAL.
• Trivial precondition: attacker only needs a registered DNSSEC-signed domain (~$10) and one lookup triggered from behind the victim resolver. No auth, no user interaction, no privileged position.
• Scope-changed integrity primitive: authenticated (AD=1) denial responses undermine security-sensitive DNS records — CAA, MTA-STS, DMARC/DKIM, OCSP, HSTS discovery. Downstream impact reaches TLS trust, email authentication, and cert issuance.
• No workaround per ISC — the only fix is upgrading BIND or disabling DNSSEC validation (which itself weakens security posture).
• Friction adjustment: the bug requires DNSSEC validation to be enabled, which is BIND's default and is on in most modern deployments; this doesn't meaningfully narrow the population.

Why not higher?

Availability and confidentiality impact are indirect — the bug is integrity-of-denial, not arbitrary RRset injection. You cannot directly redirect bank.com to an attacker IP; you can only assert non-existence of names. That ceiling keeps it out of the 9.8+ 'internet-on-fire' bracket like a resolver RCE would command.

Why not lower?

Downgrading below HIGH would require ignoring that BIND is the resolver used by a huge share of the internet's recursive tier and that the bug is in the DNSSEC validation path — the exact code path that's supposed to be the trust anchor. Deployment-role blast radius floors this at CRITICAL; friction is minimal (any registered signed zone will do).

1. Upgrade BIND to 9.18.51 / 9.20.25 / 9.21.24 (or distro-backported equivalent) — The only real fix. Roll to canary resolvers first, then production recursive tier. Deploy within 3 days per noisgate CRITICAL mitigation SLA — BIND upgrades are low-drama and the process is well-rehearsed on most fleets.
2. Temporarily route recursive DNS to a non-BIND validator — If patching is blocked, forward client resolvers to Unbound, Knot Resolver, or a trusted public resolver (1.1.1.1, 8.8.8.8, 9.9.9.9) via DoT so a compromised transit link can't strip DNSSEC. Buys days, not weeks.
3. Shorten resolver cache max-TTL to reduce poisoning dwell — Set max-cache-ttl 300 and max-ncache-ttl 300 in named.conf. Doesn't prevent poisoning but caps the damage window to 5 minutes per injection.
4. Deploy RPZ (Response Policy Zone) rules covering high-value internal names — For critical brand and internal names, an authoritative RPZ override on the resolver ensures a local answer wins over any cached NSEC denial.
5. Add monitoring for anomalous NXDOMAIN spikes on security-critical names — Alert on unexpected NXDOMAIN for _dmarc.*, _mta-sts.*, caa queries, and OCSP hosts. This is the wire-level tell of an in-progress poisoning campaign.

Run on each BIND resolver host as any user (root not required for named -v). Example: ./check-cve-2026-13321.sh. Compares installed BIND version against ISC's fixed release matrix and reports VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-13321.sh — BIND DNSSEC NSEC out-of-zone validation bypass
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

BIN=$(command -v named || true)
if [[ -z "$BIN" ]]; then
  echo "UNKNOWN: named binary not found in PATH"
  exit 2
fi

RAW=$("$BIN" -v 2>/dev/null | head -n1)
# Examples: "BIND 9.18.28-1~deb12u2-Debian" or "BIND 9.20.24-S1"
VER=$(echo "$RAW" | awk '{print $2}' | sed 's/-.*//')
SUFFIX=$(echo "$RAW" | awk '{print $2}' | grep -oE 'S1' || true)

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse version from: $RAW"
  exit 2
fi

IFS=. read -r MAJ MIN PATCH <<< "$VER"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PATCH=${PATCH:-0}

vuln=2
case "$MIN" in
  11|12|13|14|15|16|17)
    # 9.11.x–9.17.x all affected in the 9.11.0–9.18.50 band
    vuln=1 ;;
  18)
    if (( PATCH <= 50 )); then vuln=1; else vuln=0; fi ;;
  20)
    if (( PATCH <= 24 )); then vuln=1; else vuln=0; fi ;;
  21)
    if (( PATCH <= 23 )); then vuln=1; else vuln=0; fi ;;
  *)
    vuln=2 ;;
esac

# Confirm DNSSEC validation is on — bug only bites when validating
VALSTATE="unknown"
if command -v named-checkconf >/dev/null 2>&1 && [[ -r /etc/bind/named.conf || -r /etc/named.conf ]]; then
  CONF=$( [[ -r /etc/bind/named.conf ]] && echo /etc/bind/named.conf || echo /etc/named.conf )
  if grep -Eq 'dnssec-validation[[:space:]]+(auto|yes)' "$CONF" 2>/dev/null; then
    VALSTATE="enabled"
  elif grep -Eq 'dnssec-validation[[:space:]]+no' "$CONF" 2>/dev/null; then
    VALSTATE="disabled"
  else
    VALSTATE="default(auto=enabled)"
  fi
fi

case $vuln in
  0) echo "PATCHED: BIND $VER${SUFFIX:+-$SUFFIX} (validation=$VALSTATE)"; exit 0 ;;
  1) echo "VULNERABLE: BIND $VER${SUFFIX:+-$SUFFIX} affected by CVE-2026-13321 (validation=$VALSTATE)"; exit 1 ;;
  *) echo "UNKNOWN: BIND $VER${SUFFIX:+-$SUFFIX} — unrecognized version band"; exit 2 ;;
esac

Sources

1. ISC KB — CVE-2026-13321 advisory
2. Debian Security Tracker — CVE-2026-13321
3. SecurityWeek — BIND Updates Patch High-Severity Vulnerabilities
4. TechGines — BIND 9 DNSSEC Vulnerability Puts Global DNS Resolver Infrastructure at Risk
5. ISC BIND 9 DNSSEC Guide (stable)
6. Cloudflare — DNSSEC Complexities and Considerations
7. CVE Details — ISC BIND vulnerability list
8. arXiv 2403.15233 — DNSSEC denial-of-existence CPU exhaustion research (context)