CVE-2026-19668

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.27 BIND 9 versions 9.21.0 through 9.21.25 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.27-S1

Description A recursive resolver may experience excessive resource consumption when processing a large volume of specific invalid DNSSEC records. DNSSEC (Domain Name System Security Extensions) is a suite of extensions that add a layer of security to the DNS protocol by enabling DNS responses to be validated.

Recommendations Update BIND 9 versions 9.11.0 through 9.18.50 to a version newer than 9.18.50. Update BIND 9 versions 9.20.0 through 9.20.27 to a version newer than 9.20.27. Update BIND 9 versions 9.21.0 through 9.21.25 to a version newer than 9.21.25. Update BIND 9 versions 9.11.3-S1 through 9.18.50-S1 to a version newer than 9.18.50-S1. Update BIND 9 versions 9.20.9-S1 through 9.20.27-S1 to a version newer than 9.20.27-S1. Maintain the default limits for max-records-per-type and max-types-per-name to mitigate exposure.