CVE-2026-19630: BIND DNS Resolver DoS Vulnerability

CVE-2026-19630 Overview

CVE-2026-19630 is a resource exhaustion vulnerability in ISC BIND 9 resolvers. Inbound DNS protocol messages with a particular structure trigger additional processing without any limit enforced by BIND. An attacker can craft a DNS message containing a large number of these structures, forcing the resolver to consume disproportionate CPU time and memory. The flaw is categorized under [CWE-407] (Inefficient Algorithmic Complexity) and affects widely deployed BIND 9 branches including the open-source and supported -S1 subscription editions.

Critical Impact
A remote, unauthenticated attacker can degrade or disable BIND resolver availability by sending a single specially crafted DNS message, impacting any downstream service that depends on name resolution.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1

Discovery Timeline

2026-10-21 - CVE-2026-19630 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-19630

Vulnerability Analysis

The vulnerability resides in the BIND 9 resolver's handling of inbound DNS protocol messages. Certain structures inside a DNS message trigger supplementary processing paths in the resolver. BIND does not enforce an upper bound on how many of these structures a single message may contain. A malicious message crammed with these structures forces the resolver into repeated processing cycles, consuming disproportionate CPU and memory resources. Because recursive resolvers typically accept queries from a broad client base, the attack surface is network-wide and does not require authentication or user interaction.

Root Cause

The underlying weakness is inefficient algorithmic complexity. BIND processes each qualifying structure in an inbound message individually without aggregate limits, bounds checks, or early-exit heuristics. When the per-structure processing cost is multiplied by an attacker-controlled count, the aggregate work grows well beyond what the resolver was provisioned to handle, exhausting worker threads and heap memory.

Attack Vector

An unauthenticated remote attacker sends a crafted DNS message to any reachable BIND 9 resolver. The attacker needs no credentials, no prior access, and no user interaction. A single message or a low-volume stream is sufficient to pin CPU cores and inflate memory consumption, denying service to legitimate DNS clients. Internet-facing recursive resolvers and internal resolvers accessible from compromised hosts are both exposed.

No verified public exploit code is available at the time of writing. See the ISC CVE-2026-19630 Documentation for the vendor's technical description.

Detection Methods for CVE-2026-19630

Indicators of Compromise

Sustained CPU saturation of named worker threads with no corresponding increase in legitimate query volume.
Rapid growth of the named process resident memory followed by out-of-memory conditions or process restarts.
Delayed or dropped responses to recursive clients, visible as elevated SERVFAIL rates and client-side resolution timeouts.
Inbound DNS messages of unusually large size or with abnormally repetitive internal structures captured in tcpdump or passive DNS logs.

Detection Strategies

Baseline named CPU and resident set size over time, then alert on deviations that persist across multiple polling intervals.
Monitor BIND statistics channel counters for query processing time, recursive client count, and TCP client quota exhaustion.
Correlate resolver performance degradation with the source IPs of recent large or malformed inbound messages.

Monitoring Recommendations

Export BIND rndc stats output and the XML/JSON statistics channel into a centralized log or SIEM platform for trend analysis.
Capture full packet samples of inbound DNS traffic on resolver interfaces for forensic review when CPU anomalies trigger.
Alert on repeated named process restarts or crashes recorded by systemd or the host service manager.

How to Mitigate CVE-2026-19630

Immediate Actions Required

Upgrade affected BIND 9 instances to a patched release as soon as possible, prioritizing internet-facing recursive resolvers.
Restrict recursion to trusted client networks using allow-recursion and allow-query access control lists.
Rate-limit inbound DNS traffic at network edges and apply per-source query thresholds where supported.
Ensure resolver hosts have monitoring that will restart named cleanly if memory or CPU exhaustion is detected.

Patch Information

ISC has released fixed versions. Download ISC BIND 9.20.30 or ISC BIND 9.21.27 and apply the upgrade following the vendor's standard procedure. Operators of the Supported Preview Edition (-S1) should contact ISC for the corresponding patched build. Refer to the ISC CVE-2026-19630 Documentation for release notes and version mapping.

Workarounds

Place resolvers behind a DNS-aware proxy or firewall that enforces message size limits and drops malformed queries.
Reduce exposure by binding resolvers to internal interfaces only and blocking inbound UDP/TCP 53 from untrusted networks at the perimeter.
Deploy additional resolver capacity or anycast replicas so that a single-node exhaustion event does not interrupt service.

bash

# Example BIND named.conf restriction - limit recursion to trusted clients
acl "trusted" {
    10.0.0.0/8;
    192.168.0.0/16;
};

options {
    allow-query { trusted; };
    allow-recursion { trusted; };
    recursion yes;
    minimal-responses yes;
};