PT-2026-63416 · Isc · Bind 9

CVE-2026-11622 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-11622

Affected Products

Bind 9

References · 4

• https://kb.isc.org/docs/cve-2026-11622 · Vendor Advisory
• https://downloads.isc.org/isc/bind9/9.21.24 · Patch
• https://downloads.isc.org/isc/bind9/9.20.26 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11622 · Security Note