cve-2026-11622

{
  "cvss": 7.5,
  "datePublished": "2026-07-22T15:16:51.703",
  "dateUpdated": "2026-11-02T17:42:50.153",
  "description": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.",
  "id": "CVE-2026-11622",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "BIND 9",
            "vendor": "ISC",
            "versions": [
              {
                "lessThanOrEqual": "9.18.50",
                "status": "affected",
                "version": "9.11.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24",
                "status": "affected",
                "version": "9.20.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.21.23",
                "status": "affected",
                "version": "9.21.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.18.50-S1",
                "status": "affected",
                "version": "9.11.3-S1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.20.24-S1",
                "status": "affected",
                "version": "9.20.9-S1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "security-officer@isc.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "22CF447E-BD05-4B2D-B570-7C138D2C2A7C",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.11.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "F311703A-5945-4295-A036-5D878F136343",
                "versionEndIncluding": "9.18.50",
                "versionStartIncluding": "9.18.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "080D7F98-9784-4586-8ADA-CAAA0A9EC180",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:*",
                "matchCriteriaId": "AA853047-029C-4BC6-9C8C-10B183B9FB9E",
                "versionEndIncluding": "9.20.24",
                "versionStartIncluding": "9.20.9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "769711AE-516A-4D05-997D-55E3DEF5697B",
                "versionEndIncluding": "9.21.23",
                "versionStartIncluding": "9.21.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1."
      },
      {
        "lang": "es",
        "value": "Un resolvedor validador de DNSSEC que está bajo un ataque de subdominio aleatorio contra una zona firmada con DNSSEC puede sufrir un uso descontrolado de la memoria. El atacante necesita poder enviar consultas más rápido de lo que el resolvedor puede realizar la validación. El aumento del uso de memoria puede ser órdenes de magnitud más allá del límite configurado en el parámetro “max-cache-size”.\nEste problema afecta a las versiones de BIND 9 9.11.0 a 9.18.50, 9.20.0 a 9.20.24, 9.21.0 a 9.21.23, 9.11.3-S1 a 9.18.50-S1, y 9.20.9-S1 a 9.20.24-S1."
      }
    ],
    "id": "CVE-2026-11622",
    "lastModified": "2026-11-02T17:42:50.153",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "security-officer@isc.org",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-11622",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-07-22T18:53:04.346058Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-22T15:16:51.703",
    "references": [
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.20.26"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Product"
        ],
        "url": "https://downloads.isc.org/isc/bind9/9.21.24"
      },
      {
        "source": "security-officer@isc.org",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://kb.isc.org/docs/cve-2026-11622"
      }
    ],
    "sourceIdentifier": "security-officer@isc.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-770"
          }
        ],
        "source": "security-officer@isc.org",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from run..."
}