CVE-2026-10822 Details
Description
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
A vulnerability in BIND 9 has been identified, where the software accepts invalid data structures in DNS records, potentially causing the application to abort and exit unexpectedly. This issue arises when a DNS key record (such as KEY or DNSKEY) is created with a PRIVATEDNS algorithm (253) and an algorithm identifier length that exceeds the actual data length. BIND stores this invalid identifier, and when it later processes the record to render it as text, the incorrect length is used, causing a consistency check to fail. This vulnerability affects BIND 9 versions 9.18.0 prior to 9.18.50, 9.20.0 prior to 9.20.24, 9.21.0 prior to 9.21.23, as well as BIND 9 Supported Preview Edition versions 9.18.11-S1 prior to 9.18.50-S1 and 9.20.9-S1 prior to 9.20.24-S1.
Users can upgrade to BIND 9.20.26 or BIND 9.21.24. For those using BIND 9 Supported Preview Edition, the upgrade should be to version 9.20.26-S1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://downloads.isc.org/isc/bind9/9.20.26 | [email protected] | |
| https://downloads.isc.org/isc/bind9/9.21.24 | [email protected] | |
| https://kb.isc.org/docs/cve-2026-10822 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |