CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Other sources
Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.20.29-1~deb13u1Fixed in 1:9.20.29-1 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.26 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29-S1 - Configuration
Use the default limits for max-records-per-type and max-types-per-name to help mitigate resource exhaustion from excessive DNSSEC cryptographic material matching.
BIND recursive resolver max-records-per-type and max-types-per-name = default limits
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
Are default BIND configurations exposed to the same degree?
Default limits for max-records-per-type and max-types-per-name help mitigate exposure. The provided information does not state that these defaults fully eliminate the issue.
What is the expected security impact?
The reported impact is limited to availability, with no indicated confidentiality or integrity impact. The CVSS vector assigns low availability impact.
How can I identify potentially affected resolvers?
Check the installed BIND version against the reported affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.