Skip to main content

Bind 9 CVE-2026-1519

| EUVDEUVD-2026-15406 HIGH
Unchecked Input for Loop Condition (CWE-606)
2026-03-25 isc GHSA-84m6-p53c-x4wp
Information Disclosure Bind 9 Isc
7.5
CVSS 3.1 · Vendor: isc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious DNSSEC zone
  2. Delivery
    Send DNS query to vulnerable resolver
  3. Exploit
    Trigger excessive DNSSEC validation processing
  4. Execution
    Consume resolver CPU resources
  5. Impact
    Cause denial of service

Vulnerability Assessment

Weakness
CWE
CWE-606
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Unchecked input for loop condition
Exploitation Conditions

BIND resolver with DNSSEC validation enabled processing recursive queries. Affects BIND 9 versions 9.11.0–9.16.50, 9.18.0–9.18.46, 9.20.0–9.20.20, 9.21.0–9.21.19 and corresponding -S1 versions. Remote unauthenticated attacker sends maliciously crafted zone data. Authoritative-only servers generally unaffected unless configured for recursive queries.
Impact

The vulnerability presents significant real-world risk for internet-facing BIND resolvers. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates network-based exploitation with low attack complexity requiring no privileges or user interaction, enabling straightforward remote denial of service attacks. The high availability impact (A:H) reflects the CPU exhaustion condition that could render DNS resolution services unavailable, affecting dependent applications and services. Organizations running public recursive resolvers or enterprise internal DNS infrastructure with DNSSEC validation enabled should prioritize this vulnerability, as DNS service disruption has cascading effects on network operations. The availability of vendor patches across all affected branches (9.18.47, 9.20.21, 9.21.20) indicates ISC considers this exploitable and actionable. Without EPSS or KEV data suggesting active exploitation, this represents a preventive patching priority rather than an emergency incident response, but the ease of exploitation and critical nature of DNS services warrant prompt remediation within standard patch cycles.
Exploit ScenarioDerived

An attacker crafts a malicious DNS zone with specially constructed DNSSEC records designed to trigger algorithmic complexity or loop conditions during validation processing. When a vulnerable BIND resolver queries this zone (either directly or through delegation chains), the DNSSEC validation process consumes excessive CPU resources, potentially exhausting server capacity and preventing legitimate DNS resolution for other queries. The attack requires only network access to trigger queries against the malicious zone, with no authentication needed, making it straightforward for attackers to execute against public resolvers or to target enterprise DNS infrastructure through techniques like DNS cache poisoning or by registering malicious domains.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a maliciously crafted DNS zone, resulting in denial of service. The vulnerability affects BIND 9 versions from 9.11.0 through current versions across multiple branches (9.16.50, 9.18.46, 9.20.20, 9.21.19) including BIND Supported Preview Edition variants. The CVSS score of 7.5 indicates high availability impact with network-based exploitation requiring no authentication, though no active exploitation (KEV) or proof-of-concept availability has been indicated in the provided data.

RemediationAI

Upgrade BIND 9 installations immediately to patched versions: 9.18.47 or later (available at https://downloads.isc.org/isc/bind9/9.18.47), 9.20.21 or later (available at https://downloads.isc.org/isc/bind9/9.20.21), or 9.21.20 or later (available at https://downloads.isc.org/isc/bind9/9.21.20) depending on the currently deployed branch. Organizations using BIND Supported Preview Edition should apply corresponding -S1 versions. For environments where immediate patching is not feasible, consider temporarily disabling DNSSEC validation using the 'dnssec-validation no;' configuration directive, though this significantly reduces DNS security posture and should only be used as a short-term workaround until patches can be applied. Implement monitoring for abnormal CPU utilization on DNS resolver servers to detect potential exploitation attempts. Review authoritative server configurations per https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries to ensure they are not unintentionally performing recursive operations that could expose them to this vulnerability.

Affected VersionsENISA

BIND 9 9.18.11-S1 ≤9.18.46-S1
BIND 9 9.20.0 ≤9.20.20
BIND 9 9.21.0 ≤9.21.19
BIND 9 9.11.3-S1 ≤9.16.50-S1
BIND 9 9.18.0 ≤9.18.46
BIND 9 9.20.9-S1 ≤9.20.20-S1
BIND 9 9.11.0 ≤9.16.50

Affected Packages

euvd bind_9 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software on the Internet, developed and maintained by the Internet Systems Consortium (ISC). This vulnerability specifically affects BIND 9 resolver configurations performing DNSSEC (DNS Security Extensions) validation, which cryptographically verifies DNS responses to prevent tampering. The issue is classified as CWE-606 (Unchecked Input for Loop Condition), suggesting that malformed zone data can trigger algorithmic complexity attacks or unbounded processing loops during the DNSSEC validation process. The affected CPE is cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:*, encompassing all BIND 9 resolver deployments. While authoritative-only servers are generally unaffected, they may be vulnerable in configurations where they perform recursive queries for specific operational scenarios such as zone transfers, NOTIFY processing, or catalog zones.

Know when Bind 9 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (isc) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
PoC Detected
Mar 25, 2026 - 15:41 vuln.today
Public exploit code
Patch released
Mar 25, 2026 - 14:00 nvd
Patch available
CVE Published
Mar 25, 2026 - 13:25 nvd
HIGH 7.5

DescriptionCVE.org

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Executive ViewAI

Why It Matters

BIND DNS resolver servers are vulnerable to a remotely-triggered denial of service attack that could render DNS resolution unavailable across dependent systems and services. Organizations operating BIND 9 resolvers face immediate risk of service disruption affecting network connectivity, email delivery, and all internet-dependent applications without timely patching.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is delayed, implement rate limiting on DNS queries, network ACLs restricting DNS query sources, and consider failover to secondary DNS providers to maintain service continuity during remediation.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Bind 9

View all
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-94300 HIGH
8.1 Oct 21

Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess
CVE-2026-11622 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
CVE-2026-11721 HIGH
7.5 Jul 22

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
CVE-2026-80274 HIGH
7.5 Sep 16

Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2
CVE-2026-19667 HIGH
7.5 Sep 16

Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash

Same weakness CWE-606 – Unchecked Input for Loop Condition

View all
CVE-2026-62901 HIGH POC
7.5
CVE-2026-85730 HIGH POC
8.2
CVE-2024-34486 HIGH POC
7.5
CVE-2019-25624 MEDIUM POC
6.2
CVE-2026-71439 MEDIUM POC
5.3
CVE-2026-13761 HIGH
8.8
CVE-2026-20301 HIGH
8.6
CVE-2026-23689 HIGH
7.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

Ubuntu

Priority: Medium
bind9
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
upstream released 9.18.47,9.20.21,9.21.20
jammy released 1:9.18.39-0ubuntu0.22.04.3
noble released 1:9.18.39-0ubuntu0.24.04.3
questing released 1:9.20.11-1ubuntu2.2
isc-dhcp
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic needs-triage -
focal not-affected code not present
jammy not-affected code not present
noble needs-triage -
questing needs-triage -
upstream needs-triage -
bind9-libs
Release Status Version
focal needs-triage -
jammy needs-triage -
noble DNE -
questing DNE -
upstream needs-triage -
USN-8124-1

Debian

bind9
Release Status Fixed Version Urgency
bullseye vulnerable 1:9.16.50-1~deb11u2 -
bullseye (security) vulnerable 1:9.16.50-1~deb11u4 -
bookworm vulnerable 1:9.18.41-1~deb12u1 -
bookworm (security) vulnerable 1:9.18.44-1~deb12u1 -
trixie, trixie (security) vulnerable 1:9.20.18-1~deb13u1 -
forky vulnerable 1:9.20.20-1 -
sid vulnerable 1:9.20.21-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Manager Client Tools for SLE Micro 5 Fixed
SUSE Multi Linux Manager Tools SLE-Micro-5 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

References

Advisories & patches
PATCH https://downloads.isc.org/isc/bind9/9.18.47 PATCH https://downloads.isc.org/isc/bind9/9.20.21 PATCH https://downloads.isc.org/isc/bind9/9.21.20 ADVISORY https://kb.isc.org/docs/cve-2026-1519 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-1519 ADVISORY https://ubuntu.com/security/notices/USN-8124-1 ADVISORY https://vuldb.com/?id.353130 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1209/ REF https://access.redhat.com/errata/RHSA-2026:11371 REF https://access.redhat.com/errata/RHSA-2026:11372 REF https://access.redhat.com/errata/RHSA-2026:15890 REF https://access.redhat.com/errata/RHSA-2026:16060 REF https://access.redhat.com/errata/RHSA-2026:16064 REF https://access.redhat.com/errata/RHSA-2026:24500 REF https://access.redhat.com/errata/RHSA-2026:24851 REF https://access.redhat.com/errata/RHSA-2026:24934 REF https://access.redhat.com/errata/RHSA-2026:25083 REF https://access.redhat.com/errata/RHSA-2026:25171 REF https://access.redhat.com/errata/RHSA-2026:25214 REF https://access.redhat.com/errata/RHSA-2026:29110 REF https://access.redhat.com/errata/RHSA-2026:29863 REF https://access.redhat.com/errata/RHSA-2026:34048 REF https://access.redhat.com/errata/RHSA-2026:36610 REF https://access.redhat.com/errata/RHSA-2026:40021 REF https://access.redhat.com/errata/RHSA-2026:43226 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/errata/RHSA-2026:6935 REF https://access.redhat.com/errata/RHSA-2026:7915 REF https://access.redhat.com/errata/RHSA-2026:8075 REF https://access.redhat.com/errata/RHSA-2026:8155 REF https://access.redhat.com/errata/RHSA-2026:8312 REF https://access.redhat.com/errata/RHSA-2026:8352 REF https://access.redhat.com/security/cve/CVE-2026-1519 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451305 REF https://lists.debian.org/debian-lts-announce/2026/04/msg00008.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1519.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy