CVE-2026-19630: Amplified resource exhaustion in inbound message processing
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.27 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BIND resolver deployments running affected versions are exposed because the issue is triggered while processing inbound DNS protocol messages. The affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
What does an attacker need to exploit it?
An attacker needs to send inbound DNS messages containing a particular structure, with a maliciously large number of those structures. No privileges or user interaction are required according to the supplied severity vector.
What is the expected operational impact?
Processing malicious messages can consume disproportionate CPU time and memory because BIND imposes no limit on the relevant structures. This can result in an availability impact for the resolver.