Is CVE-2026-11331 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11331 being exploited in the wild.

How severe is CVE-2026-11331?

High severity, with a CVSS score of 7.5, published 22 July 2026.

Which products and versions are affected?

Isc BIND 9 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.

Is there a fix for CVE-2026-11331?

A patch was published on 2026-07-22: Patched versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11331 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11331?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11331: ISC BIND 9 RPZ policy bypass and denial of service

CVE-2026-11331 · Severity: high · CVSS 7.5 · Published 2026-07-22

A vulnerability has been identified in BIND 9, a widely used system for translating human-readable domain names into IP addresses. An attacker can send specially crafted network requests that bypass security filtering rules (Response Policy Zones) or cause the DNS service to crash. This could allow users to access restricted websites or result in a service outage for the organization.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-11331 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11331 being exploited in the wild.
How severe is CVE-2026-11331?: High severity, with a CVSS score of 7.5, published 22 July 2026.
Which products and versions are affected?: Isc BIND 9 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.
Is there a fix for CVE-2026-11331?: A patch was published on 2026-07-22: Patched versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11331 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11331?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in BIND 9's Response Policy Zone (RPZ) processing when handling wildcard CNAME policies. By crafting query names long enough to trigger a NAMETOOLONG error condition, an attacker can cause the resolver to fail to apply the intended RPZ rule or trigger an unexpected process exit. The issue stems from improper filtering of special elements (CWE-790) during the error handling phase of RPZ lookups. This is exploitable remotely via network queries without authentication. Patches are available in BIND versions 9.20.26, 9.21.24, and 9.20.26-S1.

Affected products

ISC BIND 9 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1

Timeline

2026-07-15: other: Early Notification
2026-07-22: disclosed: Public disclosure
2026-07-22: patched: Patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.