CVE-2026-10822
Key Record using PRIVATEDNS algorithm may lead to unexpected exit
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jul 22, 2026
- Updated
- Jul 22, 2026
- Reserved
- Jun 4, 2026
Description
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | isc |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
BIND 9ISC |
|
References
- CVE-2026-10822vendor-advisory
- https://downloads.isc.org/isc/bind9/9.20.26patch
- https://downloads.isc.org/isc/bind9/9.21.24patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.