# CVE-2026-11331: ISC BIND 9 RPZ policy bypass and denial of service

Source: https://junglewise.ai/threats/cve-2026-11331-isc-bind-9-rpz-policy-bypass-and-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-11331 · Severity: high · CVSS 7.5 · Published 2026-07-22

A vulnerability has been identified in BIND 9, a widely used system for translating human-readable domain names into IP addresses. An attacker can send specially crafted network requests that bypass security filtering rules (Response Policy Zones) or cause the DNS service to crash. This could allow users to access restricted websites or result in a service outage for the organization.

Technologies: [Isc BIND 9](https://junglewise.ai/threats/technologies/bind-9). Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-11331 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11331 being exploited in the wild.

**How severe is CVE-2026-11331?** High severity, with a CVSS score of 7.5, published 22 July 2026.

**Which products and versions are affected?** Isc BIND 9 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.

**Is there a fix for CVE-2026-11331?** A patch was published on 2026-07-22: Patched versions released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11331 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11331?** Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in BIND 9's Response Policy Zone (RPZ) processing when handling wildcard CNAME policies. By crafting query names long enough to trigger a NAMETOOLONG error condition, an attacker can cause the resolver to fail to apply the intended RPZ rule or trigger an unexpected process exit. The issue stems from improper filtering of special elements (CWE-790) during the error handling phase of RPZ lookups. This is exploitable remotely via network queries without authentication. Patches are available in BIND versions 9.20.26, 9.21.24, and 9.20.26-S1.

## Affected products

- ISC BIND 9 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1

## Timeline

- 2026-07-15: other: Early Notification
- 2026-07-22: disclosed: Public disclosure
- 2026-07-22: patched: Patched versions released

## References

- [https://downloads.isc.org/isc/bind9/9.20.26](https://downloads.isc.org/isc/bind9/9.20.26)
- [https://downloads.isc.org/isc/bind9/9.21.24](https://downloads.isc.org/isc/bind9/9.21.24)
- [https://kb.isc.org/docs/cve-2026-11331](https://kb.isc.org/docs/cve-2026-11331)

## Related threats

- [ISC BIND recursive server assert failure denial of service](https://junglewise.ai/threats/cve-2026-97313-a-recursive-bind-server-that-receives-a-query-with-recursion)
- [ISC BIND DNSSEC validation bypass in NSEC records](https://junglewise.ai/threats/cve-2026-13321-isc-bind-dnssec-validation-bypass-in-nsec-records)
- [ISC BIND 9 denial of service via NSEC and NSEC3 assertion failure](https://junglewise.ai/threats/cve-2026-13204-isc-bind-9-denial-of-service-via-nsec-and-nsec3-assertion-failure)
- [ISC BIND 9 denial of service via CNAME or DNAME record ordering](https://junglewise.ai/threats/cve-2026-12617-isc-bind-9-denial-of-service-via-cname-or-dname-record-ordering)
- [ISC BIND 9 cache poisoning via RRSIG label count discrepancy](https://junglewise.ai/threats/cve-2026-11721-isc-bind-9-cache-poisoning-via-rrsig-label-count-discrepancy)