High severity7.5NVD Advisory· Published Jul 22, 2026· Updated Jul 22, 2026
CVE-2026-11622
CVE-2026-11622
Description
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Affected products
39- osv-coords38 versionspkg:rpm/almalinux/bind-libspkg:rpm/almalinux/bind-licensepkg:rpm/almalinux/bind-sdbpkg:rpm/almalinux/bind9.16-licensepkg:rpm/almalinux/bind-pkcs11-develpkg:rpm/almalinux/bind-sdb-chrootpkg:rpm/almalinux/bind9.16pkg:rpm/almalinux/bind9.16-utilspkg:rpm/almalinux/bind9.16-chrootpkg:rpm/almalinux/bind9.18-develpkg:rpm/almalinux/bind9.18-utilspkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/python3-bindpkg:rpm/almalinux/python3-bind9.16pkg:rpm/almalinux/bind9.16-develpkg:rpm/almalinux/bind9.16-dnssec-utilspkg:rpm/almalinux/bind9.16-docpkg:rpm/almalinux/bind-chrootpkg:rpm/almalinux/bind-dnssec-utilspkg:rpm/almalinux/bind-docpkg:rpm/almalinux/bind-dnssec-docpkg:rpm/almalinux/bind-export-libspkg:rpm/almalinux/bind-pkcs11pkg:rpm/almalinux/bind-pkcs11-libspkg:rpm/almalinux/bind-pkcs11-utilspkg:rpm/almalinux/bind9.18-chrootpkg:rpm/almalinux/bind9.18-dnssec-utilspkg:rpm/almalinux/bind9.18-docpkg:rpm/almalinux/bind9.18-libspkg:rpm/almalinux/bind9.18pkg:rpm/almalinux/bindpkg:rpm/almalinux/bind-develpkg:rpm/almalinux/bind-utilspkg:rpm/almalinux/bind-libs-litepkg:rpm/almalinux/bind-lite-develpkg:rpm/opensuse/bind&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/bind9.16-libspkg:rpm/almalinux/bind-export-devel
< 32:9.16.23-40.el9_8.8+ 37 more
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 9.20.26-1.1
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.18.29-14.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.16.23-40.el9_8.8
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 32:9.11.36-16.el8_10.14
- (no CPE)range: < 9.20.26-160000.1.1
- (no CPE)range: < 32:9.16.23-0.22.el8_10.12
- (no CPE)range: < 32:9.11.36-16.el8_10.14
Patches
Vulnerability mechanics
References
3News mentions
1- ISC BIND 9: Nine DNSSEC and Response Handling Flaws Disclosed TogetherVypr Intelligence · Jul 23, 2026