{"id":"CVE-2026-19630","title":"Amplified resource exhaustion in inbound message processing","summary":"In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consu…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-407"],"vendor":"ISC","product":"BIND 9","affected":["bind_9 >= 9.11.0 <= 9.18.50","bind_9 >= 9.20.0 <= 9.20.29","bind_9 >= 9.21.0 <= 9.21.26","bind_9 >= 9.11.3-S1 <= 9.18.50-S1","bind_9 >= 9.20.9-S1 <= 9.20.29-S1"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:41:04.379Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-19630","references":[{"url":"https://kb.isc.org/docs/cve-2026-19630","label":"CVE-2026-19630"},{"url":"https://downloads.isc.org/isc/bind9/9.20.30"},{"url":"https://downloads.isc.org/isc/bind9/9.21.27"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T12:48:53.633Z","slug":"CVE-2026-19630","body":"## Overview\n\nIn a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND.  A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\n## Affected\n\n- `bind_9 >= 9.11.0 <= 9.18.50`\n- `bind_9 >= 9.20.0 <= 9.20.29`\n- `bind_9 >= 9.21.0 <= 9.21.26`\n- `bind_9 >= 9.11.3-S1 <= 9.18.50-S1`\n- `bind_9 >= 9.20.9-S1 <= 9.20.29-S1`\n\n## Remediation\n\nUpgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.\n\n### Workarounds\n\nNo workarounds known.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}