CVE-2026-19630: CWE-407 Inefficient Algorithmic Complexity in ISC BIND 9
Description
CVE-2026-19630 is a vulnerability in ISC BIND 9 resolver where specially crafted inbound DNS messages cause excessive CPU and memory consumption due to inefficient algorithmic complexity. This affects multiple BIND 9 versions from 9.11.0 through 9.21.26 and their respective S1 variants. The issue leads to denial of service by resource exhaustion but does not impact confidentiality or integrity.
CVSS v3.1
Score 7.5high
Affected software
ISC
BIND 9
pkg:github/isc/bind9Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from BIND 9's handling of DNS protocol messages containing a particular structure that triggers additional processing without any imposed limit. Attackers can exploit this by sending DNS messages with a maliciously large number of these structures, causing disproportionate CPU and memory usage. This inefficient algorithmic complexity (CWE-407) can degrade or disrupt service availability. Affected versions include 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and their S1 variants. The CVSS 3.1 score is 7.5 (high severity) with an attack vector of network, low attack complexity, no privileges or user interaction required, and impact limited to availability.
Potential Impact
Successful exploitation results in denial of service due to excessive CPU and memory consumption by the BIND resolver. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.
Mitigation Recommendations
No patch links are provided in the input data, and patch status is not confirmed. Users should consult the ISC vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of vulnerable BIND resolvers to untrusted networks or applying rate limiting to DNS queries if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- isc
- Date Reserved
- 2026-08-12T15:49:27.570Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad8b86f2cdf04f656f0cad2
Added to database: 10/21/2026, 13:04:47 UTC
Last enriched: 10/21/2026, 13:15:58 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.