This vulnerability (CVE-2026-1519) in ISC BIND 9 arises from unchecked input for loop conditions (CWE-606) and resource allocation without limits (CWE-770). When a BIND resolver configured for DNSSEC validation processes a maliciously crafted DNSSEC-validated zone, it may consume excessive CPU resources, leading to denial of service for legitimate users. Authoritative-only BIND servers are generally unaffected unless they perform recursive queries. The vulnerability affects multiple BIND 9 versions including 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and their S1 variants. Red Hat has issued security advisories and patches for affected products, including Red Hat Enterprise Linux Extended Life Cycle Support versions. The CVSS v3.1 score is 7.5 with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

A remote attacker can cause a denial of service by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver configured for DNSSEC validation. This results in excessive CPU resource consumption, potentially disrupting DNS resolution services for legitimate users. Authoritative-only servers are generally not impacted unless configured to perform recursive queries. There is no confidentiality or integrity impact reported.

Red Hat advisory recommends either disabling DNSSEC validation on affected BIND resolvers or configuring the BIND server as authoritative-only if recursive queries are not required. Disabling DNSSEC validation may reduce DNS security posture. A restart of the BIND service ('named') is required after applying these configuration changes. Additionally, Red Hat has released security updates that fix this vulnerability; applying these official patches is the recommended remediation. Check the vendor advisory for the latest patch availability and update instructions.