CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9 recursive resolverto a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9 recursive resolverto a version that resolves this vulnerability.Fixed in 9.21.26 - Upgrade
Upgrade
BIND 9 recursive resolverto a version that resolves this vulnerability.Fixed in 9.20.29-S1 - Configuration
Ensure the default limits on max-records-per-type are enabled to mitigate excessive resource consumption when encountering large numbers of a particular kind of invalid DNSSEC record.
BIND 9 max-records-per-type = Default limits - Configuration
Ensure the default limits on max-types-per-name are enabled to mitigate excessive resource consumption when encountering large numbers of a particular kind of invalid DNSSEC record.
BIND 9 max-types-per-name = Default limits
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
Are default BIND configurations exposed to the same degree?
Default limits for max-records-per-type and max-types-per-name help mitigate exposure. The provided information does not state that these defaults fully eliminate the issue.
What is the expected security impact?
The reported impact is limited to availability, with no indicated confidentiality or integrity impact. The CVSS vector assigns low availability impact.
How can I identify potentially affected resolvers?
Check the installed BIND version against the reported affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.