The vulnerability CVE-2026-11622 in ISC BIND 9 involves allocation of resources without limits or throttling (CWE-770). Specifically, a DNSSEC validating resolver under a high-rate random subdomain attack against a DNSSEC-signed zone can suffer from excessive memory consumption. The attacker must be able to send queries at a rate exceeding the resolver's validation capacity. This leads to memory usage that can exceed the configured max-cache-size parameter by orders of magnitude. Affected versions span multiple BIND 9 releases from 9.11.0 to 9.21.23 and their S1 variants. No official patch or remediation level has been published as of the data provided.

The vulnerability can cause a denial of service condition due to excessive memory consumption on the DNS resolver. This can degrade or disrupt DNS resolution services by exhausting system resources. There is no impact on confidentiality or integrity reported, only availability (denial of service). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor for vendor updates. In the meantime, consider limiting query rates or implementing external rate-limiting controls to reduce the risk of memory exhaustion from high query volumes targeting DNSSEC validation.