CVE-2026-13321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13321
Downstream
ALPINE (1)
ALSA (5)
AZL (1)
BELL (1)
CLSA (10)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (3)
OESA (5)
openSUSE (2)
RHSA (11)
RLSA (5)
SUSE (7)
UBUNTU (1)
Related
ALSA (5)
openSUSE (2)
SUSE (7)
Published
2026-07-22T15:16:52Z
Modified
2026-11-04T02:47:31Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

References

Affected packages

Git / github.com/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://github.com/isc-projects/bind9
Events
Introduced
1477c19dd9a347ee19a42dac227f299a4680506f
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
a37581543167cd471036b0d43e767c9ffb825625
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.11.0"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.11.3"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13321.json"

Git / gitlab.isc.org/isc-projects/bind9

Affected ranges

Type
GIT
Repo
https://gitlab.isc.org/isc-projects/bind9
Events
Introduced
1477c19dd9a347ee19a42dac227f299a4680506f
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
a37581543167cd471036b0d43e767c9ffb825625
Last Affected
ad1a84a99f853f5194ec0afc52a152f2b9579074
Introduced
14bbdfc7b9db0870a0b8941ca8812d9983fdba1a
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
98f2a5b7f486829b5644e5e9d6119c8cfefcdf70
Last Affected
e5d43f1764259da929f6c0200a9db2081141998a
Introduced
b732da695eecc0526950e2c722cde0bf23e5a070
Last Affected
ef0603035791f16bc3bb7de20099b7b4434a24cb
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.11.0"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.11.3"
                },
                {
                    "last_affected": "9.18.50"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.20.0"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
            "range": [
                {
                    "introduced": "9.20.9"
                },
                {
                    "last_affected": "9.20.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "9.21.0"
                },
                {
                    "last_affected": "9.21.23"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13321.json"