CVE Feed

    Dashboard / CVE / CVE-2026-1519

    CVE-2026-1519

    If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

    Published:Mar 25, 2026
    Last Modified:Sep 10, 2026
    EPS:Mar 25, 2026
    EPSS Score:0.01599
    CVSS Score:7.5

    Affected Products

    Vendor
    Isc
    Product
    Bind

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-12617 (CVSS 7.5) — The issue is unexpected program termination based on ordering and/or specific content in responses to queries …
    CVE-2026-11605 (CVSS 7.5) — The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all …
    CVE-2026-10723 (CVSS 6.8) — BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authentica…
    CVE-2026-10822 (CVSS 6.5) — If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and m…
    CVE-2026-13204 (CVSS 7.5) — If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RR…
    CVE-2026-11331 (CVSS 7.5) — An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names…
    CVE-2026-11622 (CVSS 7.5) — A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer f…
    CVE-2026-11721 (CVSS 7.5) — It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels …
    CVE-2026-13321 (CVSS 8.6) — The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the si…
    CVE-2026-5950 (CVSS 5.3) — An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling,…

    References

    https://downloads.isc.org/isc/bind9/9.18.47
    https://downloads.isc.org/isc/bind9/9.20.21
    https://downloads.isc.org/isc/bind9/9.21.20
    https://kb.isc.org/docs/cve-2026-1519
    https://lists.debian.org/debian-lts-announce/2026/04/msg00008.html
    https://access.redhat.com/errata/RHSA-2026:11371
    https://access.redhat.com/errata/RHSA-2026:11372
    https://access.redhat.com/errata/RHSA-2026:15890
    https://access.redhat.com/errata/RHSA-2026:16060
    https://access.redhat.com/errata/RHSA-2026:16064
    https://access.redhat.com/errata/RHSA-2026:24500
    https://access.redhat.com/errata/RHSA-2026:24851
    https://access.redhat.com/errata/RHSA-2026:24934
    https://access.redhat.com/errata/RHSA-2026:25083
    https://access.redhat.com/errata/RHSA-2026:25171
    https://access.redhat.com/errata/RHSA-2026:25214
    https://access.redhat.com/errata/RHSA-2026:29110
    https://access.redhat.com/errata/RHSA-2026:29863
    https://access.redhat.com/errata/RHSA-2026:34048
    https://access.redhat.com/errata/RHSA-2026:36610
    https://access.redhat.com/errata/RHSA-2026:40021
    https://access.redhat.com/errata/RHSA-2026:43226
    https://access.redhat.com/errata/RHSA-2026:60019
    https://access.redhat.com/errata/RHSA-2026:62549
    https://access.redhat.com/errata/RHSA-2026:6935
    https://access.redhat.com/errata/RHSA-2026:7915
    https://access.redhat.com/errata/RHSA-2026:8075
    https://access.redhat.com/errata/RHSA-2026:8155
    https://access.redhat.com/errata/RHSA-2026:8312
    https://access.redhat.com/errata/RHSA-2026:8352
    https://access.redhat.com/security/cve/CVE-2026-1519
    https://bugzilla.redhat.com/show_bug.cgi?id=2451305
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1519.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High