CVE-2026-11622

Summary

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Affected Software

VendorProductVersion RangeStatus
ISCBIND 99.11.0 <= 9.18.50affected
ISCBIND 99.20.0 <= 9.20.24affected
ISCBIND 99.21.0 <= 9.21.23affected
ISCBIND 99.11.3-S1 <= 9.18.50-S1affected
ISCBIND 99.20.9-S1 <= 9.20.24-S1affected

Weaknesses

  • CWE-770: CWE-770 Allocation of Resources Without Limits or Throttling

Workarounds

No workarounds known.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References