CVE-2026-19630

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.30
https://downloads.isc.org/isc/bind9/9.21.27
https://kb.isc.org/docs/cve-2026-19630

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En un resolvedor BIND, los mensajes entrantes del protocolo DNS con una estructura particular provocan un procesamiento adicional, sin que BIND imponga ningún límite. Un mensaje DNS con un número maliciosamente grande de esas estructuras hará que BIND consuma cantidades desproporcionadas de tiempo de CPU y memoria durante el procesamiento. \nEste problema afecta a BIND?9 desde la versión 9.11.0 hasta la versión 9.18.50 incluida, desde la versión 9.20.0 hasta la versión 9.20.29 incluida, desde la versión 9.21.0 hasta la versión 9.21.26 incluida, desde la versión 9.11.3?S1 hasta la versión 9.18.50?S1 incluida, y desde la versión 9.20.9?S1 hasta la versión 9.20.29?S1 incluida.

21 Oct 2026, 13:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 13:18

Updated : 2026-10-26 21:10

NVD link : CVE-2026-19630

Mitre link : CVE-2026-19630

CVE.ORG link : CVE-2026-19630

JSON object : View

Products Affected

No product.

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-19630", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19630", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T15:19:21.749441Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.29"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.26"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.29-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-21T13:18:32.453", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.30", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.27", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-19630", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1."}, {"lang": "es", "value": "En un resolvedor BIND, los mensajes entrantes del protocolo DNS con una estructura particular provocan un procesamiento adicional, sin que BIND imponga ning\u00fan l\u00edmite. Un mensaje DNS con un n\u00famero maliciosamente grande de esas estructuras har\u00e1 que BIND consuma cantidades desproporcionadas de tiempo de CPU y memoria durante el procesamiento. \\nEste problema afecta a BIND?9 desde la versi\u00f3n 9.11.0 hasta la versi\u00f3n 9.18.50 incluida, desde la versi\u00f3n 9.20.0 hasta la versi\u00f3n 9.20.29 incluida, desde la versi\u00f3n 9.21.0 hasta la versi\u00f3n 9.21.26 incluida, desde la versi\u00f3n 9.11.3?S1 hasta la versi\u00f3n 9.18.50?S1 incluida, y desde la versi\u00f3n 9.20.9?S1 hasta la versi\u00f3n 9.20.29?S1 incluida."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-officer@isc.org"}