The Red Hat security advisory RHSA-2026:54071 provides an update for Red Hat Hardened Images RPMs, specifically updating bind packages to version 9.20.26-0.1.hum1. Among the addressed issues is CVE-2026-11721, a vulnerability where an attacker's DNS zone can respond with an RRSIG having fewer labels than the zone, causing the named DNS server to generate a wildcard name for a shorter zone. This discrepancy can lead to DNS cache poisoning if the resolver has synth-from-dnssec enabled (default setting). The advisory lists multiple CVEs fixed in this update but does not specify affected version ranges or detailed patch instructions beyond the updated package versions. Red Hat provides a high severity rating and a CVSS v3 base score of 7.5 for CVE-2026-11721, indicating a network attack vector with low complexity and no privileges required, impacting integrity but not confidentiality or availability. The vendor advisory does not explicitly state the affected versions or confirm the patch status beyond the updated package release. No known exploits in the wild are reported. The advisory recommends applying the updated RPMs from the Red Hat Hardened Images repository.

The primary impact is DNS cache poisoning due to improper handling of RRSIG label counts in bind, which can compromise DNS integrity. This can allow an attacker to inject malicious DNS responses, potentially redirecting traffic or causing denial of service in DNS resolution. The vulnerability requires the resolver to have synth-from-dnssec enabled, which is the default setting, increasing the risk. The overall severity is high, with integrity impact rated as high and no impact on confidentiality or availability. No active exploitation is currently known.

Red Hat has released updated bind RPM packages (version 9.20.26-0.1.hum1) for multiple architectures as part of the Hardened Images update. Users should apply these updates promptly to remediate the vulnerability. The vendor advisory does not mention any alternative mitigations or workarounds, so applying the official update is the recommended action. Patch status is confirmed by the vendor advisory indicating the updated package versions. No additional mitigation steps are specified.