Is CVE-2026-19668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19668 being exploited in the wild.

How severe is CVE-2026-19668?

Medium severity, with a CVSS score of 5.3, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.

Is there a fix for CVE-2026-19668?

A patch was published on 2026-09-16: Patches released: BIND 9.18.51, 9.20.28, 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19668 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-19668?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19668: ISC BIND recursive resolver excessive resource consumption on invalid DNSSEC records

CVE-2026-19668 · Severity: medium · CVSS 5.3 · Published 2026-09-16

ISC BIND is a widely-used DNS resolver software that processes domain name queries. A vulnerability in how BIND handles malformed DNSSEC records can cause it to consume excessive CPU and memory resources when encountering certain invalid records, potentially degrading DNS service availability. Organizations running BIND recursive resolvers may experience service disruptions if targeted with specially crafted DNS traffic.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-19668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19668 being exploited in the wild.
How severe is CVE-2026-19668?: Medium severity, with a CVSS score of 5.3, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.
Is there a fix for CVE-2026-19668?: A patch was published on 2026-09-16: Patches released: BIND 9.18.51, 9.20.28, 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19668 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-19668?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service condition in BIND's recursive resolver when processing certain types of invalid DNSSEC records. The root cause involves resource consumption that scales with the number of malformed records encountered. Attack requires network connectivity to the resolver (typically UDP/TCP port 53) and involves crafting and sending specially-formed DNS queries containing invalid DNSSEC data. An attacker can exhaust resolver resources (CPU, memory) and degrade or disable DNS resolution services. Patches are available in BIND 9.18.51, 9.20.28, 9.21.26 and later versions; the built-in "max-records-per-type" and "max-types-per-name" configuration limits help mitigate exposure for unpatched systems.

Affected products

ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1

Timeline

2026-09-16: disclosed
2026-09-16: patched: Patches released: BIND 9.18.51, 9.20.28, 9.21.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.