In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. (CVE-2026-19630)

The vulnerability in BIND resolver (CVE-2026-19630) arises from processing inbound DNS protocol messages containing a particular structure that triggers unbounded additional processing by BIND. Attackers can craft DNS messages with a maliciously large number of these structures, causing BIND to consume disproportionate CPU and memory resources. This leads to a denial of service condition by exhausting system resources. The affected versions include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and the S1 variants 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation causes BIND to consume excessive CPU and memory resources, resulting in denial of service (availability impact). There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as rate limiting or filtering suspicious DNS traffic to mitigate potential exploitation.