UBUNTU-CVE-2026-19630: High severity ubuntu/bind9 vulnerability

Q: Which systems are exposed?

Systems running a BIND resolver in the affected BIND version ranges are exposed. The listed Ubuntu software includes bind9, bind9-libs, and isc-dhcp.

Q: What does an attacker need to exploit this issue?

An attacker can send specially structured inbound DNS protocol messages to a vulnerable resolver. The provided severity vector indicates network access is sufficient, with no privileges or user interaction required.

Q: Which BIND versions are affected?

Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Published Oct 21, 2026

Updated

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9*

ubuntu/isc-dhcp*

ubuntu/bind9*

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.8

1:9.18.39-0ubuntu0.22.04.8

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.9

1:9.18.39-0ubuntu0.24.04.9

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.5

1:9.20.24-1ubuntu0.5

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.9
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.5

Event History

Oct 21, 2026

CVE Published

via OSV·01:18 PM

Data Sourced

via OSV·01:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed?

Systems running a BIND resolver in the affected BIND version ranges are exposed. The listed Ubuntu software includes bind9, bind9-libs, and isc-dhcp.

What does an attacker need to exploit this issue?

An attacker can send specially structured inbound DNS protocol messages to a vulnerable resolver. The provided severity vector indicates network access is sufficient, with no privileges or user interaction required.

Which BIND versions are affected?

Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

UBUNTU-CVE-2026-19630: High severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

Which BIND versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

Which BIND versions are affected?