CVE-2026-19668: BIND DNS Resolver DoS Vulnerability

CVE-2026-19668 Overview

CVE-2026-19668 is a resource consumption vulnerability affecting Internet Systems Consortium (ISC) BIND 9 recursive resolvers. The flaw allows a remote attacker to trigger excessive resource consumption when the resolver processes large numbers of a specific class of invalid DNSSEC records. The issue is classified under CWE-407 (Inefficient Algorithmic Complexity) and impacts availability of the affected DNS service. Default values for max-records-per-type and max-types-per-name reduce exposure, but resolvers with relaxed limits remain at risk.

Critical Impact
A remote, unauthenticated attacker can degrade BIND recursive resolver performance and availability by inducing processing of many invalid DNSSEC records.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-19668 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19668

Vulnerability Analysis

The vulnerability resides in the DNSSEC validation path of the BIND 9 recursive resolver. When the resolver encounters a response containing large numbers of a particular kind of invalid DNSSEC record, its internal processing consumes disproportionate CPU and memory resources. This is an algorithmic complexity issue rather than a memory corruption flaw. The result is degraded service or denial of service for legitimate DNS clients relying on the resolver.

ISC ships default caps on max-records-per-type and max-types-per-name that limit how many records the resolver will store per RRset and per owner name. These defaults blunt the amplification effect of the attack. Operators who have raised these limits, or who use configurations that bypass them, face materially higher exposure.

Root Cause

The root cause is inefficient handling of invalid DNSSEC records during validation. Processing scales poorly as the number of malformed records grows, allowing a modest volume of crafted responses to consume outsized resolver resources.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker induces the target recursive resolver to query attacker-controlled or attacker-influenced zones that return responses containing many invalid DNSSEC records. Repeated queries amplify CPU and memory pressure, degrading resolver responsiveness for other clients.

No verified proof-of-concept code has been published. See the ISC CVE-2026-19668 Documentation for authoritative technical details.

Detection Methods for CVE-2026-19668

Indicators of Compromise

Sustained CPU or memory spikes on BIND recursive resolvers with no corresponding growth in legitimate query volume.
Elevated rates of DNSSEC validation failures logged by named for specific zones or query patterns.
Recursive queries repeatedly targeting the same suspicious zones that return oversized or malformed DNSSEC responses.

Detection Strategies

Enable named query logging and DNSSEC validation logging, then alert on abnormal ratios of validation failures to successful lookups.
Baseline recursive resolver CPU, memory, and response latency, and alert on sustained deviations that correlate with DNS traffic anomalies.
Inspect passive DNS telemetry for outbound queries to low-reputation zones returning unusually large record sets.

Monitoring Recommendations

Forward named logs and host performance metrics into a centralized analytics platform for correlation across resolvers.
Monitor counts of records per RRset and per owner name against the configured max-records-per-type and max-types-per-name thresholds.
Track resolver client-facing SERVFAIL rates as an early indicator of validation-path resource pressure.

How to Mitigate CVE-2026-19668

Immediate Actions Required

Upgrade BIND 9 to a fixed release such as 9.20.29 or 9.21.26, or to the vendor-supplied fix for your branch and Supported Preview Edition.
Verify that max-records-per-type and max-types-per-name retain their default limits and are not raised without justification.
Restrict recursion to trusted client networks using allow-recursion to limit who can drive queries through the resolver.

Patch Information

ISC has released fixed versions including ISC BIND 9.20.29 Release and ISC BIND 9.21.26 Release. Supported Preview Edition subscribers should obtain the corresponding -S1 builds from ISC. Refer to the ISC CVE-2026-19668 Documentation for the complete list of fixed releases and upgrade guidance.

Workarounds

Retain the default values for max-records-per-type and max-types-per-name to preserve built-in mitigation.
Apply rate limiting to recursive queries and place resolvers behind DNS-aware traffic controls to blunt query floods.
Consider disabling DNSSEC validation only as a temporary last resort where operational risk requires it, and revert once patched.

bash

# Configuration example: reinforce default caps and restrict recursion in named.conf
options {
    recursion yes;
    allow-recursion { trusted-clients; };
    max-records-per-type 100;
    max-types-per-name 100;
    dnssec-validation auto;
};