CVE-2026-1519 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
A maliciously crafted zone causes excessive CPU consumption in BIND resolvers during DNSSEC validation, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1519?
CVE-2026-1519 is a high-severity denial of service vulnerability in Isc Bind, published on 25 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
Which versions are affected by CVE-2026-1519?
It affects 1 product.
Linux distribution packages (40)
bind-doc AlmaLinux:10 | All versions | 32:9.18.33-10.el10_1.3 |
bind-license AlmaLinux:10 | All versions | 32:9.18.33-10.el10_1.3 |
bind AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-chroot AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-devel AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-export-devel AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-export-libs AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-libs AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-libs-lite AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-license AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-lite-devel AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-pkcs11 AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-pkcs11-devel AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-pkcs11-libs AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-pkcs11-utils AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-sdb AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-sdb-chroot AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind-utils AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
bind9.16 AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-chroot AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-devel AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-dnssec-utils AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-doc AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-libs AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-license AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind9.16-utils AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
python3-bind AlmaLinux:8 | All versions | 32:9.11.36-16.el8_10.7 |
python3-bind9.16 AlmaLinux:8 | All versions | 32:9.16.23-0.22.el8_10.5 |
bind AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-chroot AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-devel AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-dnssec-doc AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-dnssec-utils AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-doc AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-libs AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-license AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind-utils AlmaLinux:9 | All versions | 32:9.16.23-34.el9_7.2 |
bind9.18 AlmaLinux:9 | All versions | 32:9.18.29-5.el9_7.4 |
bind9.18-chroot AlmaLinux:9 | All versions | 32:9.18.29-5.el9_7.4 |
bind9.18-devel AlmaLinux:9 | All versions | 32:9.18.29-5.el9_7.4 |
Products include Isc Bind.
How do I fix CVE-2026-1519?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-1519 being exploited?
There is no known exploitation of CVE-2026-1519 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2026-1519, ALSA-2026:7915, ALSA-2026:8075, ALSA-2026:8155, ALSA-2026:8312, ALSA-2026:8352 and 53 more.