CVE-2026-1519
Description
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
How to fix
- isc bind9.18.47, 9.20.21, 9.21.20 or later
- kb.isc.org/docs/cve-2026-1519
- access.redhat.com/errata/RHSA-2026:11372
- access.redhat.com/errata/RHSA-2026:11371
- access.redhat.com/errata/RHSA-2026:34048
- access.redhat.com/errata/RHSA-2026:40021
- access.redhat.com/errata/RHSA-2026:36610
- access.redhat.com/errata/RHSA-2026:43226
- access.redhat.com/errata/RHSA-2026:62549
- access.redhat.com/errata/RHSA-2026:60019
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc bind | 9.11.0 ≤ v ≤ 9.16.50, 9.18.0 ≤ v < 9.18.47, 9.20.0 ≤ v < 9.20.21, 9.21.0 ≤ v < 9.21.20 | 9.18.47, 9.20.21, 9.21.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.