Vulnerability Report

CVE-2026-1519

Title: Excessive CPU Consumption in BIND 9 DNSSEC validation (DoS)

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-1519.

CWE Category CWE-606

Published Date Mar 25, 2026

Modified Date May 21, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

0.06%

Vulnerability Summary

CVE-2026-1519: If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Impacted Vendors

isc 1

Reference Links

https://downloads.isc.org/isc/bind9/9.18.47 https://downloads.isc.org/isc/bind9/9.20.21 https://downloads.isc.org/isc/bind9/9.21.20 https://kb.isc.org/docs/cve-2026-1519

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns