Is CVE-2026-1519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1519 being exploited in the wild.

How severe is CVE-2026-1519?

High severity, with a CVSS score of 7.5, published 25 March 2026.

Which products and versions are affected?

Isc BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, 9.20.9-S1 through 9.20.20-S1.

Is there a fix for CVE-2026-1519?

A patch was published on 2026-03-25: Patched versions 9.18.47, 9.20.21, and 9.21.20 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1519 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-1519?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1519: ISC BIND 9 denial of service via excessive NSEC3 iterations

CVE-2026-1519 · Severity: high · CVSS 7.5 · Published 2026-03-25

ISC BIND 9 is a widely used software for managing Domain Name System (DNS) services. A vulnerability in its security validation process allows a remote attacker to send specially crafted data that causes the server to consume excessive processor resources. This can lead to a significant slowdown or complete loss of DNS service, preventing users from accessing websites and other network resources.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-1519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1519 being exploited in the wild.
How severe is CVE-2026-1519?: High severity, with a CVSS score of 7.5, published 25 March 2026.
Which products and versions are affected?: Isc BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, 9.20.9-S1 through 9.20.20-S1.
Is there a fix for CVE-2026-1519?: A patch was published on 2026-03-25: Patched versions 9.18.47, 9.20.21, and 9.21.20 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1519 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-1519?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in BIND 9 resolvers when performing DNSSEC validation. The issue is caused by unchecked input for loop conditions (CWE-606) during the validation of insecure delegations involving NSEC3 records. A remote attacker can provide a maliciously crafted zone with excessive NSEC3 iterations, forcing the resolver to spend an inordinate amount of CPU time on validation. This results in a sharp decrease in the number of queries per second (QPS) the resolver can handle. Authoritative-only servers are generally unaffected unless they are configured to perform recursive queries. Patches are available in versions 9.18.47, 9.20.21, and 9.21.20.

Affected products

ISC BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, 9.20.9-S1 through 9.20.20-S1

Timeline

2026-03-18: other: Early notification provided to partners
2026-03-25: advisory: Public disclosure by ISC
2026-03-25: patched: Patched versions 9.18.47, 9.20.21, and 9.21.20 released
2026-04-13: other: Debian LTS advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.