CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.

BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing.

This Moderate impact flaw in BIND allows a specially crafted DNS key record with a PRIVATEDNS algorithm and overlong algorithm identifier to cause the named daemon to abort when rendering the record to text. The attack requires prior storage of the malformed record (requiring user interaction), limiting the immediate risk to most Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the patched release most closely related to your current version of BIND 9:

• 9.20.26
• 9.21.24

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

• 9.20.26-S1