Description
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Resource Exhaustion
Action: Patch Now
AI Analysis

Impact

In ISC BIND 9 resolvers, specially crafted inbound DNS messages containing a large number of a particular internal structure trigger additional, unbounded processing. This lack of a processing limit causes the resolver to consume disproportionate amounts of CPU time and memory, leading to a denial of service. The weakness is a classic example of resource exhaustion (CWE-407, CWE-770).

Affected Systems

Affected by this flaw are all ISC BIND 9 releases from 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and their corresponding security‑extended S1 releases (9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1).

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity vulnerability. With an EPSS score of less than 1% and the flaw not listed in the CISA KEV catalog, the publicly observable exploitation likelihood remains low, but the nature of the flaw means it can be triggered simply by sending crafted DNS queries over the network. Attackers do not need privileged access or authentication; any entity able to direct traffic to the vulnerable DNS server can initiate the resource‑heavy processing that leads to denial of service.

Generated by OpenCVE AI on October 22, 2026 at 15:46 UTC.

Remediation

Vendor Solution

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.

Vendor Workaround

No workarounds known.

OpenCVE Recommended Actions

  • Upgrade to the patched releases most closely related to your current BIND 9 version: 9.20.30, 9.21.27, or 9.20.30‑S1 as recommended by ISC.
  • If an immediate upgrade is not possible, implement network‑level controls such as rate limiting or firewall rules to reduce the volume of inbound DNS queries that can reach the resolver.
  • Configure BIND to limit recursion and response sizes or to drop unrecognized query types to reduce the processing overhead for malformed messages.

Generated by OpenCVE AI on October 22, 2026 at 15:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6576-1 bind9 security update
Ubuntu USN Ubuntu USN USN-8969-1 Bind vulnerabilities
History

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Isc bind 9
Vendors & Products Isc bind 9

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-770
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 21 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Title Amplified resource exhaustion in inbound message processing
First Time appeared Isc
Isc bind
Weaknesses CWE-407
CPEs cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Vendors & Products Isc
Isc bind
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Isc Bind Bind 9
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: isc

Published:

Updated: 2026-10-21T17:19:14.434Z

Reserved: 2026-08-12T15:49:27.570Z

Link: CVE-2026-19630

cve-icon Vulnrichment

Updated: 2026-10-21T17:10:01.170Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T13:18:32.453

Modified: 2026-10-26T21:10:00.170

Link: CVE-2026-19630

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-21T00:00:00Z

Links: CVE-2026-19630 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:00:11Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-770

    Allocation of Resources Without Limits or Throttling