CVE-2026-11622: BIND 9 DNSSEC DoS Vulnerability

CVE-2026-11622 Overview

CVE-2026-11622 is a resource exhaustion vulnerability in ISC BIND 9 DNSSEC validating resolvers. An attacker can trigger runaway memory consumption by launching a random subdomain attack against a DNSSEC-signed zone. When queries arrive faster than the resolver can validate, memory usage grows orders of magnitude beyond the max-cache-size limit. The flaw affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the supported subscription editions 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1. The weakness is categorized under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote unauthenticated attacker can exhaust resolver memory, causing denial of service for all DNS clients relying on the affected BIND 9 instance.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.24 and 9.21.0 through 9.21.23
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1

Discovery Timeline

2026-07-22 - CVE-2026-11622 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-11622

Vulnerability Analysis

The vulnerability affects the DNSSEC validation path in BIND 9 resolvers. When a resolver receives queries for random, non-existent subdomains under a DNSSEC-signed zone, it must fetch and validate signed NSEC or NSEC3 records for each name. Random subdomain attacks, also known as NXNSAttack or water torture variants, generate a high volume of unique query names to defeat caching.

DNSSEC validation is CPU and memory intensive. When query arrival rate exceeds validation throughput, pending validation state accumulates in memory. The resolver continues to allocate structures for in-flight validations without bounding them against the configured cache size. Memory growth can exceed the max-cache-size parameter by orders of magnitude, eventually exhausting host resources.

Root Cause

The root cause is missing throttling on resources allocated during concurrent DNSSEC validation [CWE-770]. The max-cache-size control governs cached response data but does not bound the memory used by pending validation contexts. Attackers exploit this asymmetry to force unbounded allocation.

Attack Vector

The attack requires only network access to the resolver, no authentication, and no user interaction. An attacker sends a flood of queries for randomized subdomains of any DNSSEC-signed zone. Each query forces the resolver to initiate a new validation chain. When the query rate exceeds the validator's throughput, allocated state grows without limit until the process is killed by the operating system or the host becomes unresponsive.

No verified public exploit code is available at the time of publication. See the ISC CVE-2026-11622 Documentation for the vendor's technical description.

Detection Methods for CVE-2026-11622

Indicators of Compromise

Sustained high volume of DNS queries for unique, non-existent subdomains under one or a few parent zones
BIND named process resident set size growing far beyond the configured max-cache-size value
Elevated SERVFAIL response rates and rising client query timeouts
Operating system OOM killer terminating the named process

Detection Strategies

Enable BIND query logging and alert on high rates of NXDOMAIN responses from a small set of DNSSEC-signed parent zones
Monitor named statistics channel counters for validation activity and recursive client queue depth
Correlate DNS query telemetry with host memory metrics to identify divergence between cache size and process memory

Monitoring Recommendations

Ship BIND query logs and statistics to a centralized analytics platform for baseline and anomaly detection
Track process memory of named alongside max-cache-size and alert on ratios greater than two
Instrument upstream network devices to flag sudden spikes in DNS query rates targeting recursive resolvers

How to Mitigate CVE-2026-11622

Immediate Actions Required

Upgrade to a fixed BIND 9 release, specifically 9.20.26 or 9.21.24, as published by ISC
Subscription users should apply the corresponding -S1 patched builds provided by ISC support
Apply rate limiting on recursive resolvers using fetches-per-server and fetches-per-zone to constrain outstanding fetches
Restrict recursion to trusted client networks with allow-recursion access control lists

Patch Information

ISC has released fixed versions available at ISC BIND 9.20.26 Download and ISC BIND 9.21.24 Download. Refer to the ISC CVE-2026-11622 Documentation for release notes and full patch details.

Workarounds

Configure fetches-per-zone with a low quota and enable the drop action to shed excess queries during an attack
Lower recursive-clients to bound concurrent recursion state per instance
Deploy Response Rate Limiting (RRL) upstream and place resolvers behind DNS-aware DDoS mitigation appliances

bash

# Example BIND options to constrain fetch state (apply after upgrading)
options {
    recursive-clients 1000;
    fetches-per-zone 200 drop;
    fetches-per-server 100;
    max-cache-size 512m;
    allow-recursion { trusted_clients; };
};