CVE-2026-11331

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11331
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11331.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11331
Downstream
ALPINE (1)
ALSA (4)
AZL (1)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (3)
OESA (4)
openSUSE (2)
RHSA (9)
RLSA (4)
SUSE (6)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (6)
Published
2026-07-22T15:16:51Z
Modified
2026-11-04T02:47:23Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

References

Affected packages

Git / github.com/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://github.com/isc-projects/bind9
Events
Introduced
539f9f0860fcf0429ec891249473825ad6fead9c
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
8db45afa1affcb823e68afdeddedf93e136f5d3e
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.16.8"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.18.0"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v9.*
v9.18.0
v9.18.50

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11331.json"

Git / gitlab.isc.org/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://gitlab.isc.org/isc-projects/bind9
Events
Introduced
539f9f0860fcf0429ec891249473825ad6fead9c
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
8db45afa1affcb823e68afdeddedf93e136f5d3e
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.16.8"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.18.0"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v9.*
v9.18.0
v9.18.50

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11331.json"