BIND 9 CVE-2026-11622

Requires the target BIND 9 instance to be operating as a DNSSEC-validating resolver and to be resolving names in a DNSSEC-signed zone that the attacker queries with random, nonexistent subdomains. The attacker must be able to reach the resolver over the network (AV:N, PR:N - unauthenticated per the CVSS vector) and, critically, must sustain a query rate faster than the resolver can complete DNSSEC validation, which demands adequate bandwidth/query-generation capacity. Exploitation is limited where DNSSEC validation is disabled, where recursion is restricted to trusted clients by ACL, or where effective per-client rate limiting is in place; resolvers open to the internet without such controls are most at risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, unauthenticated availability-only impact, which matches the description. Real risk is moderated by prerequisites the raw score does not surface: the resolver must be DNSSEC-validating (common but not universal), the target must be a DNSSEC-signed zone, and the attacker must sustain a query rate exceeding validation throughput - implying meaningful bandwidth/effort rather than a single packet. There is no EPSS score, no POC, and no KEV listing provided, so this is a credible operator-impacting DoS but not evidence of widespread active exploitation; treat it as high-priority patching for internet-facing or high-value resolvers rather than an emergency zero-day. The AC:L rating is arguable - success depends on out-pacing validation, which some environments would consider added complexity; the vendor's A:H is consistent with a full memory-exhaustion crash.

An attacker points a query generator at a victim's publicly reachable DNSSEC-validating resolver and sends a high-rate stream of queries for randomly generated, nonexistent subdomains (e.g. a1b2c3.victim-signed-zone.example) of a DNSSEC-signed zone. Because each query spawns a validation that outpaces completion, in-flight state accumulates and named's memory climbs far past max-cache-size until the process is killed by the OS or the host is exhausted, denying DNS service to all legitimate users. No exploit code is publicly identified, and network-level (AV:N) low-complexity access is all that is required.