Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an unexpected exit of the BIND 9 software.
ISC DHCP is not affected by CVE-2026-11331. This is a BIND server-side RPZ (Response Policy Zone) processing issue; ISC DHCP does not use RPZ. Additionally, the affected BIND versions start at 9.16.0, while ISC DHCP bundles bind-export-libs 9.11.36, which is below the affected range. ISC DHCP uses portions of the ISC BIND libraries (primarily libdns, omapi, and libisccfg) only to support DDNS (TSIG support, DNS message construction/parsing, DHCID generation), OMAPI-related operations, and basic functions (configuration handling, data structures, logging, networking primitives), not for DNS resolver or RPZ functionality.