CVE-2026-19668

ISC's BIND 9 DNS server contains a resource-exhaustion flaw (CWE-407) in which a recursive resolver consumes excessive CPU and memory when it encounters large numbers of a particular kind of invalid DNSSEC record. A remote, unauthenticated attacker can trigger this by causing a BIND resolver to process attacker-influenced DNSSEC data — for example, by having the resolver look up names served from authoritative servers that return the malformed records — degrading or halting DNS resolution (availability impact only, per the CVSS vector). Any organization operating a BIND recursive resolver in the affected version ranges is exposed, including internet-facing open resolvers and internal enterprise, campus, and ISP resolvers; ISC notes that default settings of the 'max-records-per-type' and 'max-types-per-name' limits help mitigate the exposure. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; it was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.

What to do: Inventory all BIND 9 recursive resolvers (recursion enabled) and upgrade them to the first patched release in their branch per ISC's advisory for CVE-2026-19668 — i.e., versions newer than the affected ranges 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, and 9.20.9-S1–9.20.27-S1 (or the corresponding newer Subscription builds). Until patched, keep the default 'max-records-per-type' and 'max-types-per-name' limits in place (do not raise them) and restrict recursion to trusted client networks via allow-recursion ACLs, prioritizing resolvers that are internet-reachable or resolve external names.