Bug 2524373 - CVE-2026-13321 dhcp: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field [fedora-all]
Summary: CVE-2026-13321 dhcp: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: dhcp
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Martin Osvald 🛹
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["b4a88e03-41e7-409c-9b8d-e...
Depends On:
Blocks: CVE-2026-13321
TreeView+ depends on / blocked
 
Reported: 2026-08-26 12:31 UTC by Thomas Eagle
Modified: 2026-09-14 10:26 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-09-14 10:26:41 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Thomas Eagle 2026-08-26 12:31:48 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The resolver accepts validly-signed NSEC records where the "Next
  Domain Name" field points outside the signer's zone. An attacker
  controlling ANY DNSSEC-signed zone can craft NSEC records spanning
  into victim zones, enabling cross-zone cache poisoning with AD=1
  (Authenticated Data flag set)

Comment 1 Martin Osvald 🛹 2026-09-14 10:26:41 UTC
ISC DHCP is not affected by CVE-2026-13321. This is a BIND server-side DNSSEC validation issue; ISC DHCP does not perform DNSSEC validation.

ISC DHCP uses portions of the ISC BIND libraries (primarily libdns, omapi, and libisccfg) only to support DDNS (TSIG support, DNS message construction/parsing, DHCID generation), OMAPI-related operations, and basic functions (configuration handling, data structures, logging, networking primitives).


Note You need to log in before you can comment on or make changes to this bug.