CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. The invalid identifier will be stored. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.26-S1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.26
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10822?
The severity of CVE-2026-10822 is classified as medium, with a CVSS score of 6.5.
How do I fix CVE-2026-10822?
To fix CVE-2026-10822, update your ISC BIND software to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2026-10822?
CVE-2026-10822 may cause BIND to abort and exit unexpectedly when processing certain invalid DNS records.
Which versions of ISC BIND are affected by CVE-2026-10822?
ISC BIND versions prior to the fixed releases announced after July 22, 2026, are vulnerable to CVE-2026-10822.
What conditions lead to CVE-2026-10822 being exploited?
CVE-2026-10822 can be exploited if BIND stores a DNS record for a key that specifies a PRIVATEDNS algorithm and encounters an invalid data structure.