EUVD-2026-15406

| CVE-2026-1519 HIGH
2026-03-25 isc GHSA-84m6-p53c-x4wp
7.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
PoC Detected
Mar 25, 2026 - 15:41 vuln.today
Public exploit code
Analysis Generated
Mar 25, 2026 - 14:00 vuln.today
EUVD ID Assigned
Mar 25, 2026 - 14:00 euvd
EUVD-2026-15406
Patch Released
Mar 25, 2026 - 14:00 nvd
Patch available
CVE Published
Mar 25, 2026 - 13:25 nvd
HIGH 7.5

Tags

Information Disclosure Ubuntu Debian Redhat Suse

Description

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Analysis

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a maliciously crafted DNS zone, resulting in denial of service. The vulnerability affects BIND 9 versions from 9.11.0 through current versions across multiple branches (9.16.50, 9.18.46, 9.20.20, 9.21.19) including BIND Supported Preview Edition variants. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Inventory all BIND 9 instances and identify those running vulnerable versions (9.11.0-9.16.50, 9.18.0-9.18.46, 9.20.0-9.20.20, 9.21.0-9.21.19). Within 7 days: Deploy vendor patches to all affected BIND resolvers in a staged approach, prioritizing production DNS infrastructure. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +38
POC: +20

Vendor Status

Ubuntu

Priority: Medium
bind9
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
upstream released 9.18.47,9.20.21,9.21.20
jammy released 1:9.18.39-0ubuntu0.22.04.3
noble released 1:9.18.39-0ubuntu0.24.04.3
questing released 1:9.20.11-1ubuntu2.2
isc-dhcp
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic needs-triage -
focal not-affected code not present
jammy not-affected code not present
noble needs-triage -
questing needs-triage -
upstream needs-triage -
bind9-libs
Release Status Version
focal needs-triage -
jammy needs-triage -
noble DNE -
questing DNE -
upstream needs-triage -
USN-8124-1

Debian

bind9
Release Status Fixed Version Urgency
bullseye vulnerable 1:9.16.50-1~deb11u2 -
bullseye (security) vulnerable 1:9.16.50-1~deb11u4 -
bookworm vulnerable 1:9.18.41-1~deb12u1 -
bookworm (security) vulnerable 1:9.18.44-1~deb12u1 -
trixie, trixie (security) vulnerable 1:9.20.18-1~deb13u1 -
forky vulnerable 1:9.20.20-1 -
sid vulnerable 1:9.20.21-1 -
(unstable) fixed (unfixed) -

Share

EUVD-2026-15406 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy