CVE-2026-13321 HIGH

CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

Vendor Isc

Product BIND 9

Weakness CWE-346 · Origin validation

Published July 22, 2026

Last update July 22, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Key dates

02Disclosure timeline

July 22, 2026 CVE published

July 22, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13321 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/346.html AskarLabs — CWE-346 write-up Origin Validation Error

Identifiers

CVE CVE-2026-13321

CWE CWE-346

CVSS 8.6 / HIGH

Affected versions

Vendor Isc

Product BIND 9

Affected ≥ 9.11.0 and ≤ 9.18.50

Vendor Isc

Product BIND 9

Affected ≥ 9.20.0 and ≤ 9.20.24

Vendor Isc

Product BIND 9

Affected ≥ 9.21.0 and ≤ 9.21.23

Vendor Isc

Product BIND 9

Affected ≥ 9.11.3-S1 and ≤ 9.18.50-S1

Vendor Isc

Product BIND 9

Affected ≥ 9.20.9-S1 and ≤ 9.20.24-S1