CVE-2026-1519

EUVD-2026-15406
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries).
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
iscCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
bind9
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bind9
bionic
needs-triage
focal
needs-triage
jammy
Fixed 1:9.18.39-0ubuntu0.22.04.3
released
noble
Fixed 1:9.18.39-0ubuntu0.24.04.3
released
questing
Fixed 1:9.20.11-1ubuntu2.2
released
trusty
needs-triage
xenial
needs-triage
isc-dhcp
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
needs-triage
questing
needs-triage
trusty
not-affected
xenial
not-affected
bind9-libs
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
Common Weakness Enumeration
References
https://downloads.isc.org/isc/bind9/9.18.47
https://downloads.isc.org/isc/bind9/9.20.21
https://downloads.isc.org/isc/bind9/9.21.20
https://kb.isc.org/docs/cve-2026-1519