Skip to main content

BIND 9 CVE-2026-11622

| EUVDEUVD-2026-47708 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-22 isc GHSA-g5c7-92qw-5486
7.5
CVSS 3.1 · Vendor: isc
Share

Severity by source

Vendor (isc) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remotely reachable, unauthenticated flood (AV:N/PR:N) against a validating resolver causes memory-exhaustion outage with no confidentiality or integrity impact, so availability-only A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 15:17 vuln.today
CVE Published
Jul 22, 2026 - 14:12 cve.org
HIGH 7.5

DescriptionCVE.org

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

AnalysisAI

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-validating resolver with random-subdomain ('water torture') queries against a DNSSEC-signed zone. When queries arrive faster than the resolver can complete validation, memory consumption grows unbounded - orders of magnitude beyond the configured max-cache-size - eventually crashing the service. Affects a broad span of 9.11 through 9.21 release and supported-preview (-S) branches; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

BIND 9 (cpe:2.3:a:isc:bind_9) is the reference open-source DNS implementation, widely used as a recursive/validating resolver. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) condition in the DNSSEC validation path: each pending validation for a nonexistent random subdomain of a signed zone holds state and memory while the resolver fetches and cryptographically verifies the signed denial-of-existence (NSEC/NSEC3) records. The max-cache-size parameter bounds the answer cache but does not bound this transient in-flight validation state, so a sustained backlog of unfinished validations accumulates memory the operator believed was capped.

RemediationAI

Vendor-released patch: upgrade to BIND 9.20.26 (https://downloads.isc.org/isc/bind9/9.20.26) or 9.21.24 (https://downloads.isc.org/isc/bind9/9.21.24), per the ISC advisory at https://kb.isc.org/docs/cve-2026-11622; supported-preview users should move to the corresponding fixed -S build. If immediate patching is not possible, reduce exposure by restricting recursion to trusted clients (allow-recursion / allow-query-cache ACLs) so arbitrary internet hosts cannot drive the query flood, and apply per-client rate limiting to throttle the random-subdomain traffic - noting these controls limit but do not fully eliminate memory growth and can affect legitimate clients if scoped too tightly. Monitoring named's resident memory with alerting well below system limits gives early warning while the upgrade is scheduled.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali

CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec

CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW

CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro

CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe

CVE-2026-11721 HIGH
7.5 Jul 22

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged

CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po

CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an

CVE-2026-3039 HIGH
7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at

CVE-2026-5946 HIGH
7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th

CVE-2026-10723 MEDIUM
6.8 Jul 22

DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-11622 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy