CVE-2026-11721

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set synth-from-dnssec yes; (which is the default).

Red Hat has evaluated this vulnerability as Important because a remote, unauthenticated attacker can poison the DNS resolver cache without prior privileges or user interaction, potentially spoofing records across the network. In Red Hat Enterprise Linux environments utilizing BIND as a recursive resolver, this condition is present under default settings. Authoritative-only configurations or isolated instances not performing recursive lookups for untrusted clients remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.