CVE-2026-11622
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.
Risk Assessment
Excessive memory consumption can lead to denial of service (DoS) for the DNS resolver, preventing name resolution.
Recommendation
Update BIND 9 to version 9.18.51, 9.20.25, 9.21.24 or later, which contain the fix.
Other vulnerabilities in BIND 9
See all- CVE-2025-13878High
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This vulnerability affects specific versions of BIND 9.
- CVE-1999-0024Medium
CVE-1999-0024 vulnerability involves a malicious attack on DNS cache via BIND, exploiting predictable query IDs.
- CVE-2026-13321High
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.
- CVE-2026-13204High
BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.
- CVE-2026-12617High
BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.
- CVE-2026-11721High
In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).
- CVE-2026-11605High
Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.
- CVE-2026-11331High
BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.
- CVE-2026-10822Medium
A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.
- CVE-2026-10723Medium
BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.
Original NVD description (English source)
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.