A critical origin validation flaw in the ISC BIND 9 resolver allows for the acceptance of invalid NSEC records, posing a risk to DNS integrity.

This is an origin validation error (CWE-346) occurring within the BIND resolver. The vulnerability allows an unauthenticated remote attacker to cause the resolver to accept malformed NSEC records, which could impact the integrity of DNSSEC-signed zones.

Successful exploitation allows for the manipulation of DNSSEC validation results. This could lead to redirection or spoofing of DNS traffic, potentially resulting in unauthorized access, data interception, or service disruption. Given the CVSS score of 8.6, this vulnerability represents a high-severity risk to network infrastructure.

Immediate Action: Upgrade to the patched releases: 9.20.26, 9.21.24, or 9.20.26-S1.

Proactive Monitoring: Monitor DNS resolver logs for unusual NSEC record processing or high volumes of validation failures.

Compensating Controls: Ensure DNSSEC validation is strictly configured and consider using additional DNS security layers to monitor for anomalous query responses.

Public Exploit Available: Unknown

The severity of this flaw necessitates immediate attention for all organizations utilizing BIND 9. Administrators should verify their current version and apply the recommended patches to ensure DNSSEC validation remains robust against manipulation attempts.