Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-21T00:00:00 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU and memory resources without requiring privileges, resulting in a denial of service. In Red Hat Enterprise Linux and OpenShift environments, the risk primarily affects BIND instances functioning as recursive resolvers exposed to untrusted traffic. Deployments serving strictly authoritative roles or those isolated from untrusted client queries experience significantly lower exposure to this attack vector. Red Hat Enterprise Linux 10 2026-10-29T00:00:00Z RHSA-2026:92419 bind-32:9.18.33-15.el10_2.14 Red Hat Enterprise Linux 9 2026-10-30T00:00:00Z RHSA-2026:93072 bind9.18-32:9.18.29-14.el9_8.12 Red Hat Hardened Images 2026-10-21T00:00:00Z RHSA-2026:87309 bind-main-9.20.30-0.1.hum1 Red Hat Enterprise Linux 6 Affected bind Red Hat Enterprise Linux 7 Affected bind Red Hat Enterprise Linux 8 Affected bind Red Hat Enterprise Linux 8 Affected bind9.16 Red Hat Enterprise Linux 9 Affected bind Red Hat Enterprise Linux 9 Affected dhcp Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-19630 https://nvd.nist.gov/vuln/detail/CVE-2026-19630 https://kb.isc.org/docs/cve-2026-19630