Live › vulnerability › CVE-2026-19630
Go to dashboardA crafted inbound DNS message with a very large number of a specific record structure makes a BIND resolver do unbounded extra processing. An attacker can exhaust CPU and memory on the resolver, causing slowdown or denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running BIND 9 as a recursive resolver that answers queries from clients the operator does not control, including ISP, enterprise and internet-facing resolvers. Authoritative-only servers and resolvers limited to trusted internal clients are less exposed. Versions outside the listed ranges are not affected per the sources.
No product ranges from the sources yet.
named -V or named -v to read the BIND version and compare it with the affected ranges.recursion yes; in named.conf) that accepts queries from untrusted networks.9.18.50, 9.20.29, 9.21.26, 9.18.50-S1 and 9.20.29-S1 to a fixed release from ISC.allow-recursion until patched.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
This page as .md · .json · in your agent: get_signal("CVE-2026-19630")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.