# CVE-2026-19668: ISC BIND recursive resolver excessive resource consumption on invalid DNSSEC records

Source: https://junglewise.ai/threats/cve-2026-19668-isc-bind-recursive-resolver-excessive-resource-consumption-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19668 · Severity: medium · CVSS 5.3 · Published 2026-09-16

ISC BIND is a widely-used DNS resolver software that processes domain name queries. A vulnerability in how BIND handles malformed DNSSEC records can cause it to consume excessive CPU and memory resources when encountering certain invalid records, potentially degrading DNS service availability. Organizations running BIND recursive resolvers may experience service disruptions if targeted with specially crafted DNS traffic.

Technologies: [Isc Bind](https://junglewise.ai/threats/technologies/bind). Vendors: [Isc](https://junglewise.ai/threats/vendors/isc).

## Quick answers

**Is CVE-2026-19668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19668 being exploited in the wild.

**How severe is CVE-2026-19668?** Medium severity, with a CVSS score of 5.3, published 16 September 2026.

**Which products and versions are affected?** Isc Bind 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1.

**Is there a fix for CVE-2026-19668?** A patch was published on 2026-09-16: Patches released: BIND 9.18.51, 9.20.28, 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19668 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-19668?** Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service condition in BIND's recursive resolver when processing certain types of invalid DNSSEC records. The root cause involves resource consumption that scales with the number of malformed records encountered. Attack requires network connectivity to the resolver (typically UDP/TCP port 53) and involves crafting and sending specially-formed DNS queries containing invalid DNSSEC data. An attacker can exhaust resolver resources (CPU, memory) and degrade or disable DNS resolution services. Patches are available in BIND 9.18.51, 9.20.28, 9.21.26 and later versions; the built-in "max-records-per-type" and "max-types-per-name" configuration limits help mitigate exposure for unpatched systems.

## Affected products

- ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released: BIND 9.18.51, 9.20.28, 9.21.26

## References

- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)
- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)

## Related threats

- [BIND assertion failure with redirect zone and qname-minimization](https://junglewise.ai/threats/cve-2026-96888-a-bind-resolver-that-is-configured-with-both-a-redirect-zone-and)
- [BIND named GSS-TSIG replay heap corruption](https://junglewise.ai/threats/cve-2026-94300-replaying-gss-tsig-signed-udp-messages-can-result-in-memory)
- [ISC BIND resolver DNS message processing denial of service](https://junglewise.ai/threats/cve-2026-19630-in-a-bind-resolver-inbound-dns-protocol-messages-with-a)
- [ISC BIND denial of service via TKEY queries](https://junglewise.ai/threats/cve-2015-5477-isc-bind-data-processing-errors-vulnerability)
- [BIND resolver crash on DNSSEC-signed wildcard with NSEC mismatch](https://junglewise.ai/threats/cve-2026-80274-bind-resolver-crash-on-dnssec-signed-wildcard-with-nsec-mismatch)