CVE-2026-11622

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1

Description A DNSSEC validating resolver can experience runaway memory usage when subjected to a random subdomain attack against a DNSSEC-signed zone. This occurs if an attacker sends queries faster than the resolver can perform validation, causing memory consumption to exceed the limit defined in the max-cache-size parameter by several orders of magnitude.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.