CVE-2026-19630 Amplified resource exhaustion in inbound message processing
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-19630?
CVE-2026-19630 is a high-severity vulnerability in ISC BIND 9, published on 21 Oct 2026.
Official description
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Weakness: CWE-407
Which versions are affected by CVE-2026-19630?
How do I fix CVE-2026-19630?
Upgrade to a fixed version.
Is CVE-2026-19630 being exploited?
There is no known exploitation of CVE-2026-19630 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-19630, AZL-111506, BELL-CVE-2026-19630, DEBIAN-CVE-2026-19630, ECHO-105d-eb6f-2f1a, GHSA-53h2-668w-c49r and 2 more.