CVE-2026-11331Patch

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-790

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
11 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 8 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
Peaked 4d ago at 4 mentions (2026-07-22); latest day: 2
11 total mentions across 5 days

Deep dive

Activity timeline11 mentions / 5d

Signal classification2 categories

Patch

872.7%

Disclosure

327.3%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-22	4	Disclosure3Patch1
2026-07-23	2	Patch2
2026-08-09	1	Patch1
2026-08-14	2	Patch2
2026-08-17	2	Patch2

Full discourse11 posts

Laith Mash'al@LaithMshal73d
Patch
الحمدلله قبل عدة أشهر اكتشفت ثغرة في BIND 9 أحد أهم برامج البنية التحتية للـ DNS على الإنترنت حول العالم تم إصلاحها ونشرها رسميًا CVE-2026-11331. أول CVE لي، والقصة كاملة هنا: https://laithmashal.dev/research/cve-2026-11331-bind-rpz-policy-bypass
Post summary
The author reports discovering CVE‑2026‑11331 in BIND 9, notes it was patched and released, and links to the full write‑up, but does not mention a PoC, exploit tool, or active exploitation.
91101721310.8K
8.6K followersView on X
日本レジストリサービス（JPRS）@JPRS_official91d
Patch
【注意喚起】（緊急）BIND 9.xの脆弱性（RPZの設定のバイパス、DNSサービスの停止）について（CVE-2026-11331） - バージョンアップを強く推奨 - https://jprs.jp/tech/security/2026-07-23-bind9-vuln-rpz.html
Post summary
An urgent notice warns of a BIND 9.x vulnerability (RPZ bypass and DNS stop) under CVE-2026-11331 and strongly recommends upgrading to mitigate the risk.
05080704
1.3K followersView on X
Yasuhiro Morishita@OrangeMorishita91d
Patch
【自分用メモ】BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822)と修正バージョン(9.20.26, 9.21.24) https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/
Post summary
A personal memo enumerates multiple BIND 9 vulnerabilities with severity ratings and the corresponding patch versions (9.20.26, 9.21.24), linking to a security advisory for more information.
12080922
4.6K followersView on X
Yu F@fj_twt91d
Patch
( ꒪⌓꒪)…灼熱の特大号 New BIND 9 releases: 9.20.26, 9.21.24 https://lists.isc.org/pipermail/bind-announce/2026-July/001299.html https://kb.isc.org/docs/cve-2026-10723 https://kb.isc.org/docs/cve-2026-10822 https://kb.isc.org/docs/cve-2026-11331 https://kb.isc.org/docs/cve-2026-11605 https://kb.isc.org/docs/cve-2026-11622 https://kb.isc.org/docs/cve-2026-11721 https://kb.isc.org/docs/cve-2026-12617 https://kb.isc.org/docs/cve-2026-13204 https://kb.isc.org/docs/cve-2026-13321
Post summary
The tweet announces BIND 9 9.20.26 and 9.21.24 releases that include fixes for several CVEs, providing links to vendor documentation, but does not mention exploits, PoCs, or active attacks.
01180835
1.6K followersView on X
Kazuki Omo@omokazuki91d
Disclosure
BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #dns #bind https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/
Post summary
The post lists several high- and medium‑severity BIND 9 CVEs and links to a site covering the disclosures, but no exploits, patches, or active exploitation details are provided.
02040332
372 followersView on X
まこぴ@makopicut68d
Patch
RHSA-2026:54509 - bind9.16 security update (RHEL8) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:54509
Post summary
The Red Hat erratum RHSA-2026:54509 announces patches for several CVEs affecting bind9.16 on RHEL8, providing a link to the vendor advisory.
11011123
117 followersView on X
まこぴ@makopicut68d
Patch
RHSA-2026:54510 - bind security update (RHEL9) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:54510
Post summary
Red Hat issued RHSA-2026:54510, a security advisory that patches six listed CVEs.
1001061
117 followersView on X
まこぴ@makopicut65d
Patch
RHSA-2026:55437 - bind security update (RHEL10) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:55437
Post summary
Red Hat Security Advisory RHSA-2026:55437 lists six CVEs fixed in a RHEL10 bind update, confirming available patches without providing technical or exploit details.
1000043
117 followersView on X
まこぴ@makopicut65d
Patch
RHSA-2026:55442 - bind9.18 security update (RHEL9) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:55442
Post summary
Red Hat released a security update (RHSA‑2026:55442) addressing six CVEs in bind9.18 on RHEL9, indicating patches are available for these vulnerabilities.
0000037
117 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition du… https://www.cve.org/CVERecord?id=CVE-2026-11331 ----- Traducción: CVE-2026-11331 Un … http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-11331, noting that resolvers employing RPZ with wildcard CNAME policies can be abused by sending long query names to trigger a NAMETOOLONG error, but it provides no PoC, exploit code, patch, or active exploitation evidence.
0000029
94 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition du… https://www.cve.org/CVERecord?id=CVE-2026-11331
Post summary
The post explains how attackers can use long DNS queries on resolvers with RPZ wildcard CNAME policies to trigger a NAMETOOLONG error, highlighting a potential denial-of-service vulnerability.
00000872
57.8K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-11331

Laith Mash'al[verified]@LaithMshalPatch

The author reports discovering CVE‑2026‑11331 in BIND 9, notes it was patched and released, and links to the full write‑up, but does not mention a PoC, exploit tool, or active exploitation.

Yasuhiro Morishita[verified]@OrangeMorishitaPatch

A personal memo enumerates multiple BIND 9 vulnerabilities with severity ratings and the corresponding patch versions (9.20.26, 9.21.24), linking to a security advisory for more information.

Yu F[verified]@fj_twtPatch

The tweet announces BIND 9 9.20.26 and 9.21.24 releases that include fixes for several CVEs, providing links to vendor documentation, but does not mention exploits, PoCs, or active attacks.

日本レジストリサービス（JPRS）@JPRS_officialPatch

An urgent notice warns of a BIND 9.x vulnerability (RPZ bypass and DNS stop) under CVE-2026-11331 and strongly recommends upgrading to mitigate the risk.

Kazuki Omo@omokazukiDisclosure

The post lists several high- and medium‑severity BIND 9 CVEs and links to a site covering the disclosures, but no exploits, patches, or active exploitation details are provided.

まこぴ@makopicutPatch

The Red Hat erratum RHSA-2026:54509 announces patches for several CVEs affecting bind9.16 on RHEL8, providing a link to the vendor advisory.

まこぴ@makopicutPatch

Red Hat issued RHSA-2026:54510, a security advisory that patches six listed CVEs.

まこぴ@makopicutPatch

Red Hat Security Advisory RHSA-2026:55437 lists six CVEs fixed in a RHEL10 bind update, confirming available patches without providing technical or exploit details.