{"id":"CVE-2026-19630","kind":"vulnerability","aliases":["CVE-2026-19630"],"related":[],"title":"BIND: crafted DNS messages make the resolver burn CPU and memory","description":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","summary":"A crafted inbound DNS message with a very large number of a specific record structure makes a BIND resolver do unbounded extra processing. An attacker can exhaust CPU and memory on the resolver, causing slowdown or denial of service.","severity":"high","cvss":7.5,"epss":0.00448,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bind","dns","infrastructure","linux","self-hosted"],"not_affected_if":["authoritative-only","recursion-restricted","version-outside-range"],"how_to_check":"- Run `named -V` or `named -v` to read the BIND version and compare it with the affected ranges.\n- Check whether the host runs BIND as a recursive resolver (`recursion yes;` in named.conf) that accepts queries from untrusted networks.","fix":"- Upgrade BIND 9 branches past the affected ranges: move past `9.18.50`, `9.20.29`, `9.21.26`, `9.18.50-S1` and `9.20.29-S1` to a fixed release from ISC.\n- Restrict recursive queries to trusted clients with `allow-recursion` until patched.","status":"open","published_at":"2026-10-21T13:18:32+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:52+00:00","updated_at":"2026-10-25T03:16:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:16:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BIND 9 branches past the affected ranges: move past `9.18.50`, `9.20.29`, `9.21.26`, `9.18.50-S1` and `9.20.29-S1` to a fixed release from ISC.\n- Restrict recursive queries to trusted clients with `allow-recursion` until patched.","reach":"network","title":"BIND: crafted DNS messages make the resolver burn CPU and memory","impact":"medium","summary":"A crafted inbound DNS message with a very large number of a specific record structure makes a BIND resolver do unbounded extra processing. An attacker can exhaust CPU and memory on the resolver, causing slowdown or denial of service.","category":"infrastructure","nicknames":[],"who_cares":["bind","dns","self-hosted","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"resolver CPU and memory exhausted, causing denial of service","analyst_note":"Sources give no exploit detail or fixed version numbers; confirm the patched release in the ISC advisory for CVE-2026-19630 and whether recursion-off servers are unaffected.","how_to_check":"- Run `named -V` or `named -v` to read the BIND version and compare it with the affected ranges.\n- Check whether the host runs BIND as a recursive resolver (`recursion yes;` in named.conf) that accepts queries from untrusted networks.","needs_analyst":true,"not_affected_if":["authoritative-only","recursion-restricted","version-outside-range"],"who_is_affected":"Operators running BIND 9 as a recursive resolver that answers queries from clients the operator does not control, including ISP, enterprise and internet-facing resolvers. Authoritative-only servers and resolvers limited to trusted internal clients are less exposed. Versions outside the listed ranges are not affected per the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3449,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19630':14A,17A '-2026':13A,16A '9':116C '9.11.0':118C '9.11.3':127C '9.18.50':120C,130C '9.20.0':121C '9.20.29':123C,136C '9.20.9':133C '9.21.0':124C '9.21.26':126C 'addit':79C 'affect':114C 'amount':104C 'attack':49B 'bind':1A,18B,42B,66C,86C,100C,115C 'burn':8A 'caus':58B,99C 'consum':102C 'cpu':9A,52B,106C 'craft':2A,26B 'cve':12A,15A 'denial':61B 'disproportion':103C 'dns':3A,19B,28B,69C,88C 'exhaust':51B 'extra':46B 'host':24B 'impos':84C 'inbound':27B,68C 'infrastructur':20B 'issu':113C 'larg':33B,93C 'limit':83C 'linux':21B 'make':5A,40B 'malici':92C 'memori':11A,54B,109C 'messag':4A,29B,71C,89C 'number':34B,94C 'particular':74C 'process':47B,80C,111C 'protocol':70C 'record':38B 'resolv':7A,43B,57B,67C 'result':77C 's1':128C,131C,134C,137C 'self':23B 'self-host':22B 'servic':63B 'slowdown':59B 'specif':37B 'structur':39B,75C,97C 'time':107C 'unbound':45B 'version':117C","nicknames":[],"mitigations":[],"who_affected":"Operators running BIND 9 as a recursive resolver that answers queries from clients the operator does not control, including ISP, enterprise and internet-facing resolvers. Authoritative-only servers and resolvers limited to trusted internal clients are less exposed. Versions outside the listed ranges are not affected per the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-officer@isc.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19630","severity":null,"published_at":"2026-10-21T13:18:32+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-19630","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19630","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}