CVE-2026-11622
Received Received - Intake

Memory Exhaustion in BIND DNSSEC Resolver

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Internet Systems Consortium (ISC)

Description
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-11622
EUVD
EUVD-2026-47708

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
isc bind 9.11.0
isc bind 9.18.50
isc bind 9.20.0
isc bind 9.20.24
isc bind 9.21.0
isc bind 9.21.23
isc bind 9.11.3-s1
isc bind 9.18.50-s1
isc bind 9.20.9-s1
isc bind 9.20.24-s1
isc bind 9.20.26
isc bind 9.21.24
isc bind 9.20.26-s1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-11622 is a vulnerability in BIND 9 DNSSEC validating resolvers. It occurs when an attacker sends rapid DNS queries to a DNSSEC-signed zone under a random subdomain attack. The resolver cannot validate these queries fast enough, causing runaway memory usage that can exceed the configured max-cache-size limit by orders of magnitude.

Detection Guidance

Monitor BIND resolver memory usage and DNS query rates. Check for excessive memory consumption beyond max-cache-size limits. Use system tools like 'top', 'htop', or 'ps' to observe BIND process memory usage. Review DNS query logs for unusually high query volumes from specific sources.

Impact Analysis

This vulnerability can lead to excessive memory consumption on the DNS resolver, potentially causing system slowdowns or crashes. It may degrade DNS response rates and impact the availability of DNS services. The attack requires the attacker to send queries faster than the resolver can validate them.

Compliance Impact

This vulnerability primarily impacts system availability due to excessive memory consumption, which could lead to service degradation or outages. While not directly violating GDPR or HIPAA, such disruptions may affect compliance with availability requirements in these regulations. Organizations must ensure DNSSEC resolvers are patched to maintain reliable service and avoid potential compliance gaps.

Mitigation Strategies

Upgrade BIND to patched versions: 9.20.26, 9.21.24, or their Supported Preview Edition equivalents (9.20.26-S1, 9.21.24-S1). If immediate upgrade is not possible, consider temporarily reducing query load or implementing rate limiting on DNS queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart