What is the CVSS score of CVE-2026-1519?

CVE-2026-1519 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bind 9 are affected by CVE-2026-1519?

BIND DNS resolver servers are vulnerable to a remotely-triggered denial of service attack that could render DNS resolution unavailable across dependent systems and services.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1519?

Yes, a public proof-of-concept exploit is available for CVE-2026-1519. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1519?

Within 24 hours: Inventory all BIND 9 instances and identify those running vulnerable versions (9.11.0-9.16.50, 9.18.0-9.18.46, 9.20.0-9.20.20, 9.21.0-9.21.19). Within 7 days: Deploy vendor patches to all affected BIND resolvers in a staged approach, prioritizing production DNS infrastructure. Within 30 days: Complete patching across all environments and conduct post-patch validation testing of DNS resolution.

Bind 9 CVE-2026-1519

EUVD-2026-15406 HIGH

Unchecked Input for Loop Condition (CWE-606)

2026-03-25 isc

GHSA-84m6-p53c-x4wp

Information Disclosure Bind 9

7.5

CVSS 3.1 · Vendor: isc

Severity by source

Vendor (isc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

PoC Detected

Mar 25, 2026 - 15:41 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 14:00 euvd

EUVD-2026-15406

Analysis Generated

Mar 25, 2026 - 14:00 vuln.today

Patch released

Mar 25, 2026 - 14:00 nvd

Patch available

CVE Published

Mar 25, 2026 - 13:25 nvd

HIGH 7.5

DescriptionCVE.org

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

AnalysisAI

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a maliciously crafted DNS zone, resulting in denial of service. The vulnerability affects BIND 9 versions from 9.11.0 through current versions across multiple branches (9.16.50, 9.18.46, 9.20.20, 9.21.19) including BIND Supported Preview Edition variants. The CVSS score of 7.5 indicates high availability impact with network-based exploitation requiring no authentication, though no active exploitation (KEV) or proof-of-concept availability has been indicated in the provided data.

Technical ContextAI

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software on the Internet, developed and maintained by the Internet Systems Consortium (ISC). This vulnerability specifically affects BIND 9 resolver configurations performing DNSSEC (DNS Security Extensions) validation, which cryptographically verifies DNS responses to prevent tampering. The issue is classified as CWE-606 (Unchecked Input for Loop Condition), suggesting that malformed zone data can trigger algorithmic complexity attacks or unbounded processing loops during the DNSSEC validation process. The affected CPE is cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:*, encompassing all BIND 9 resolver deployments. While authoritative-only servers are generally unaffected, they may be vulnerable in configurations where they perform recursive queries for specific operational scenarios such as zone transfers, NOTIFY processing, or catalog zones.

RemediationAI

Upgrade BIND 9 installations immediately to patched versions: 9.18.47 or later (available at https://downloads.isc.org/isc/bind9/9.18.47), 9.20.21 or later (available at https://downloads.isc.org/isc/bind9/9.20.21), or 9.21.20 or later (available at https://downloads.isc.org/isc/bind9/9.21.20) depending on the currently deployed branch. Organizations using BIND Supported Preview Edition should apply corresponding -S1 versions. For environments where immediate patching is not feasible, consider temporarily disabling DNSSEC validation using the 'dnssec-validation no;' configuration directive, though this significantly reduces DNS security posture and should only be used as a short-term workaround until patches can be applied. Implement monitoring for abnormal CPU utilization on DNS resolver servers to detect potential exploitation attempts. Review authoritative server configurations per https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries to ensure they are not unintentionally performing recursive operations that could expose them to this vulnerability.

More in Bind 9

View all

CVE-2026-3104 HIGH This Week POC

7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec

CVE-2026-3593 CRITICAL Act Now

9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW

CVE-2026-3039 HIGH This Week

7.5 May 20

Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at

CVE-2026-5946 HIGH This Week

7.5 May 20

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th

CVE-2026-3119 MEDIUM This Month

6.5 Mar 25

BIND 9 DNS server crashes when processing specially crafted TSIG-authenticated queries containing TKEY records, affectin

CVE-2026-5947 MEDIUM This Month

5.9 May 20

Denial of service in ISC BIND 9 resolvers can be triggered when a SIG(0)-signed DNS message is dropped under recursive-c

CVE-2026-3591 MEDIUM This Month

5.4 Mar 25

A use-after-return vulnerability in ISC BIND 9's SIG(0) DNS query handler allows an attacker with low-level authenticati

Same weakness CWE-606 – Unchecked Input for Loop Condition

View all

CVE-2024-34486 HIGH POC

7.5

CVE-2019-25624 MEDIUM POC

6.2

7.7

7.7

7.5

7.1

CVE-2026-27145 MEDIUM

6.5

CVE-2023-6237 MEDIUM

5.9

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Ubuntu

Priority: Medium

bind9

Release	Status	Version
trusty	needs-triage	-
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
upstream	released	9.18.47,9.20.21,9.21.20
jammy	released	1:9.18.39-0ubuntu0.22.04.3
noble	released	1:9.18.39-0ubuntu0.24.04.3
questing	released	1:9.20.11-1ubuntu2.2

isc-dhcp

Release	Status	Version
trusty	not-affected	code not present
xenial	not-affected	code not present
bionic	needs-triage	-
focal	not-affected	code not present
jammy	not-affected	code not present
noble	needs-triage	-
questing	needs-triage	-
upstream	needs-triage	-

bind9-libs

Release	Status	Version
focal	needs-triage	-
jammy	needs-triage	-
noble	DNE	-
questing	DNE	-
upstream	needs-triage	-

USN-8124-1

Debian

bind9

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	1:9.16.50-1~deb11u2	-
bullseye (security)	vulnerable	1:9.16.50-1~deb11u4	-
bookworm	vulnerable	1:9.18.41-1~deb12u1	-
bookworm (security)	vulnerable	1:9.18.44-1~deb12u1	-
trixie, trixie (security)	vulnerable	1:9.20.18-1~deb13u1	-
forky	vulnerable	1:9.20.20-1	-
sid	vulnerable	1:9.20.21-1	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: High

Product	Status
SUSE Manager Client Tools for SLE Micro 5	Fixed
SUSE Multi Linux Manager Tools SLE-Micro-5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-1519 vulnerability details – vuln.today

Back

Bind 9 CVE-2026-1519

Severity by source

CVSS VectorVendor: isc

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Bind 9

Same weakness CWE-606 – Unchecked Input for Loop Condition

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code