A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Jul 28, 2026 | Jul 22, 2026 |
| Amazon Linux Ami 2 | — | Upgrade bind-libs-liteUpgrade bind-debuginfoUpgrade bind-export-libsUpgrade bind-chrootUpgrade bindUpgrade bind-sdbUpgrade bind-pkcs11Upgrade bind-lite-develUpgrade bind-export-develUpgrade bind-pkcs11-libsUpgrade bind-pkcs11-develUpgrade bind-develUpgrade bind-pkcs11-utilsUpgrade bind-sdb-chrootUpgrade bind-utilsUpgrade bind-libsUpgrade bind-license | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade bind-utilsUpgrade bind-docUpgrade bind-develUpgrade bind-chrootUpgrade bind-debuginfoUpgrade bind-libs-debuginfoUpgrade bind-utils-debuginfoUpgrade bind-dnssec-utils-debuginfoUpgrade bind-dnssec-utilsUpgrade bind-licenseUpgrade bindUpgrade bind-libsUpgrade bind-debugsource | Aug 10, 2026 | Jul 22, 2026 |
| Debian | — | Upgrade bind9 | Jul 28, 2026 | Jul 28, 2026 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Sep 18, 2026 | Sep 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for bind_advisory31 | Sep 16, 2026 | Sep 16, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 26, 2026 | Jul 22, 2026 |
| Redhat_linux | — | Upgrade bind-pkcs11-libs-debuginfoUpgrade bind-pkcs11-libsUpgrade bind9.16-debugsourceUpgrade bind-export-libs-debuginfoUpgrade bind-utilsUpgrade bind-libsUpgrade bind-sdbUpgrade bind9.18-dnssec-utilsUpgrade bind-pkcs11Upgrade bind-libs-lite-debuginfoUpgrade bind9.16-dnssec-utils-debuginfoUpgrade bind9.16-utilsUpgrade bind9.16-utils-debuginfoUpgrade bind9.16-develUpgrade bind9.16Upgrade bind9.16-chrootUpgrade bind-pkcs11-debuginfoUpgrade bind-pkcs11-utils-debuginfoUpgrade bind-debuginfoUpgrade python3-bindUpgrade bind9.16-libs-debuginfoUpgrade bind9.18-chrootUpgrade bind-docUpgrade bind-dnssec-docUpgrade bind-chrootUpgrade bind9.18-debugsourceUpgrade python3-bind9.16Upgrade bind-lite-develUpgrade bind9.18-debuginfoUpgrade bind9.18-utils-debuginfoUpgrade bind9.18-docUpgrade bind-export-develUpgrade bind-sdb-chrootUpgrade bind-dnssec-utils-debuginfoUpgrade bind-sdb-debuginfoUpgrade bind9.16-docUpgrade bindUpgrade bind9.16-debuginfoUpgrade bind-dnssec-utilsUpgrade bind-debugsourceUpgrade bind-libs-liteUpgrade bind-libs-debuginfoUpgrade bind9.18-libsUpgrade bind9.16-dnssec-utilsUpgrade bind-pkcs11-develUpgrade bind9.18-utilsUpgrade bind-export-libsUpgrade bind-pkcs11-utilsUpgrade bind-utils-debuginfoUpgrade bind9.18-develUpgrade bind9.18Upgrade bind9.18-dnssec-utils-debuginfoUpgrade bind9.18-libs-debuginfoUpgrade bind9.16-licenseUpgrade bind-licenseUpgrade bind9.16-libsNo solution existsUpgrade bind-devel | Jul 24, 2026 | Jul 22, 2026 |
| Rocky_linux | — | Upgrade bind-chrootUpgrade bind-lite-develUpgrade bind-pkcs11-debuginfoUpgrade bind9.16-dnssec-utils-debuginfoUpgrade bind-pkcs11-libs-debuginfoUpgrade bind9.18-debuginfoUpgrade bind9.18-dnssec-utils-debuginfoUpgrade bind9.16Upgrade bind-pkcs11-utils-debuginfoUpgrade bind-libs-lite-debuginfoUpgrade bind-debuginfoUpgrade bind-export-libs-debuginfoUpgrade bind-sdbUpgrade bind-pkcs11-utilsUpgrade bind9.16-debugsourceUpgrade bind9.16-libs-debuginfoUpgrade bind9.16-utils-debuginfoUpgrade bind-libs-liteUpgrade bind-pkcs11-libsUpgrade bind9.16-develUpgrade bind9.18-utils-debuginfoUpgrade bind9.18-dnssec-utilsUpgrade bind-libsUpgrade bind-utilsUpgrade bind9.18-debugsourceUpgrade bind9.18-chrootUpgrade bind-debugsourceUpgrade bind-pkcs11-develUpgrade bind-pkcs11Upgrade bind9.16-chrootUpgrade bindUpgrade bind9.16-dnssec-utilsUpgrade bind-dnssec-utils-debuginfoUpgrade bind-utils-debuginfoUpgrade bind9.18-utilsUpgrade bind-sdb-debuginfoUpgrade bind-sdb-chrootUpgrade bind9.16-utilsUpgrade bind9.16-debuginfoUpgrade bind-export-libsUpgrade bind-libs-debuginfoUpgrade bind-develUpgrade bind-dnssec-utilsUpgrade bind-export-develUpgrade bind9.18-develUpgrade bind9.18Upgrade bind9.18-libs-debuginfoUpgrade bind9.16-libsUpgrade bind9.18-libs | Aug 17, 2026 | Aug 15, 2026 |
| Ubuntu | — | Upgrade bind9 | Aug 19, 2026 | Aug 19, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 17, 2026 | Jul 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub