Log in Start free

Vulnerability · Published Mar 25, 2026 · Assigned by isc

CVE-2026-1519Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

High 7.5

In plain English

A high-severity resource allocation without limits in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8bind32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind-chroot32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind-chroot32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind-devel32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind-devel32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:9bind-dnssec-doc32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:9bind-dnssec-utils32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:10bind-doc32:9.18.33-10.el10_1.3ALSA-2026:8312
AlmaLinux:9bind-doc32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind-export-devel32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-export-libs32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-libs32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind-libs32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind-libs-lite32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:10bind-license32:9.18.33-10.el10_1.3ALSA-2026:8312
AlmaLinux:8bind-license32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind-license32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind-lite-devel32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-pkcs1132:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-pkcs11-devel32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-pkcs11-libs32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-pkcs11-utils32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-sdb32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-sdb-chroot32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:8bind-utils32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9bind-utils32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8bind9.1632:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-chroot32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-devel32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-dnssec-utils32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-doc32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-libs32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-license32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:8bind9.16-utils32:9.16.23-0.22.el8_10.5ALSA-2026:8155
AlmaLinux:9bind9.1832:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-chroot32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-devel32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-dnssec-utils32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-doc32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-libs32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:9bind9.18-utils32:9.18.29-5.el9_7.4ALSA-2026:7915
AlmaLinux:8python3-bind32:9.11.36-16.el8_10.7ALSA-2026:8352
AlmaLinux:9python3-bind32:9.16.23-34.el9_7.2ALSA-2026:8075
AlmaLinux:8python3-bind9.1632:9.16.23-0.22.el8_10.5ALSA-2026:8155
Alpine:v3.20bind9.18.47-r0ALPINE-CVE-2026-1519
Alpine:v3.21bind9.18.47-r0ALPINE-CVE-2026-1519
Alpine:v3.22bind9.20.21-r0ALPINE-CVE-2026-1519
Alpine:v3.23bind9.20.21-r0ALPINE-CVE-2026-1519
Alpine:v3.24bind9.20.21-r0ALPINE-CVE-2026-1519
Debian:12bind91:9.18.47-1~deb12u1DEBIAN-CVE-2026-1519
Debian:12bind91:9.18.47-1~deb12u1DSA-6181-1
Debian:13bind91:9.20.21-1~deb13u1DEBIAN-CVE-2026-1519
Debian:13bind91:9.20.21-1~deb13u1DSA-6181-1
Debian:14bind91:9.20.21-1DEBIAN-CVE-2026-1519
Rocky Linux:10bind2:9.18.33-10.el10_1.3RLSA-2026:8312
Rocky Linux:8bind2:9.11.36-16.el8_10.7RLSA-2026:8352
Rocky Linux:9bind2:9.16.23-34.el9_7.2RLSA-2026:8075
Rocky Linux:8bind9.162:9.16.23-0.22.el8_10.5RLSA-2026:8155
Rocky Linux:9bind9.182:9.18.29-5.el9_7.4RLSA-2026:7915
Ubuntu:22.04:LTSbind91:9.18.39-0ubuntu0.22.04.3UBUNTU-CVE-2026-1519
Ubuntu:22.04:LTSbind91:9.18.39-0ubuntu0.22.04.7USN-8929-1
Ubuntu:24.04:LTSbind91:9.18.39-0ubuntu0.24.04.3UBUNTU-CVE-2026-1519
Ubuntu:24.04:LTSbind91:9.18.39-0ubuntu0.24.04.8USN-8929-1
Ubuntu:25.10bind91:9.20.11-1ubuntu2.2UBUNTU-CVE-2026-1519
Ubuntu:26.04:LTSbind91:9.20.24-1ubuntu0.4USN-8929-1
Ubuntu:22.04:LTSbind9-libsno fix listedUBUNTU-CVE-2026-1519
Ubuntu:24.04:LTSisc-dhcpno fix listedUBUNTU-CVE-2026-1519
Ubuntu:25.10isc-dhcpno fix listedUBUNTU-CVE-2026-1519
Ubuntu:26.04:LTSisc-dhcpno fix listedUBUNTU-CVE-2026-1519

Affected products (as reported)

VendorProductVersions
ISC BIND 9 9.11.0 – through 9.16.509.18.0 – through 9.18.469.20.0 – through 9.20.209.21.0 – through 9.21.199.11.3-S1 – through 9.16.50-S19.18.11-S1 – through 9.18.46-S19.20.9-S1 – through 9.20.20-S1

Weakness: CWE-606, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References