High
Security advisory
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-1519
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:55 UTC · Revision 1
Source evidence
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
osv:CVE-2026-1519
Complete source record
{
"id": "f83880c9aef37a13e38be66c44eef1aa1097c811c5229a2f22bc9c0b236c4829",
"url": "https://osv.dev/vulnerability/CVE-2026-1519",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-1519",
"summary": "If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.",
"evidence": "osv:CVE-2026-1519",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-1519",
"aliases": [
"CVE-2026-1519"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/isc-projects/bind9",
"type": "GIT",
"events": [
{
"introduced": "1477c19dd9a347ee19a42dac227f299a4680506f"
},
{
"last_affected": "acf2ba4a9337bced7e666b0460db4f58a4611eb8"
},
{
"introduced": "8db45afa1affcb823e68afdeddedf93e136f5d3e"
},
{
"fixed": "84c0d37e126c1ef36345a4f5b0ccd4faf1528c1e"
},
{
"introduced": "14bbdfc7b9db0870a0b8941ca8812d9983fdba1a"
},
{
"fixed": "12f97d4162d435940598de4870d0088b8e6d266c"
},
{
"introduced": "b732da695eecc0526950e2c722cde0bf23e5a070"
},
{
"fixed": "3e7037ceef40688d5b4eb4a55a9df80c7547dd9f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.11.0"
},
{
"last_affected": "9.16.50"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.18.0"
},
{
"fixed": "9.18.47"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.20.0"
},
{
"fixed": "9.20.21"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.21.0"
},
{
"fixed": "9.21.20"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v9.18.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1519.json"
}
},
{
"ranges": [
{
"repo": "https://gitlab.isc.org/isc-projects/bind9",
"type": "GIT",
"events": [
{
"introduced": "1477c19dd9a347ee19a42dac227f299a4680506f"
},
{
"last_affected": "acf2ba4a9337bced7e666b0460db4f58a4611eb8"
},
{
"introduced": "8db45afa1affcb823e68afdeddedf93e136f5d3e"
},
{
"fixed": "84c0d37e126c1ef36345a4f5b0ccd4faf1528c1e"
},
{
"introduced": "14bbdfc7b9db0870a0b8941ca8812d9983fdba1a"
},
{
"fixed": "12f97d4162d435940598de4870d0088b8e6d266c"
},
{
"introduced": "b732da695eecc0526950e2c722cde0bf23e5a070"
},
{
"fixed": "3e7037ceef40688d5b4eb4a55a9df80c7547dd9f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.11.0"
},
{
"last_affected": "9.16.50"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.18.0"
},
{
"fixed": "9.18.47"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.20.0"
},
{
"fixed": "9.20.21"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "9.21.0"
},
{
"fixed": "9.21.20"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v9.18.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1519.json"
}
}
],
"modified": "2026-10-24T10:30:23.162224034Z",
"provider": "osv",
"references": [
"https://access.redhat.com/security/cve/CVE-2026-1519",
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1519.json",
"https://access.redhat.com/errata/RHSA-2026:11371",
"https://access.redhat.com/errata/RHSA-2026:11372",
"https://access.redhat.com/errata/RHSA-2026:15890",
"https://access.redhat.com/errata/RHSA-2026:16060",
"https://access.redhat.com/errata/RHSA-2026:16064",
"https://access.redhat.com/errata/RHSA-2026:24500",
"https://access.redhat.com/errata/RHSA-2026:24851",
"https://access.redhat.com/errata/RHSA-2026:24934",
"https://access.redhat.com/errata/RHSA-2026:25083",
"https://access.redhat.com/errata/RHSA-2026:25171",
"https://access.redhat.com/errata/RHSA-2026:25214",
"https://access.redhat.com/errata/RHSA-2026:29110",
"https://access.redhat.com/errata/RHSA-2026:29863",
"https://access.redhat.com/errata/RHSA-2026:34048",
"https://access.redhat.com/errata/RHSA-2026:36610",
"https://access.redhat.com/errata/RHSA-2026:40021",
"https://access.redhat.com/errata/RHSA-2026:43226",
"https://access.redhat.com/errata/RHSA-2026:60019",
"https://access.redhat.com/errata/RHSA-2026:62549",
"https://access.redhat.com/errata/RHSA-2026:65851",
"https://access.redhat.com/errata/RHSA-2026:6935",
"https://access.redhat.com/errata/RHSA-2026:7915",
"https://access.redhat.com/errata/RHSA-2026:8075",
"https://access.redhat.com/errata/RHSA-2026:8155",
"https://access.redhat.com/errata/RHSA-2026:8312",
"https://access.redhat.com/errata/RHSA-2026:8352",
"https://kb.isc.org/docs/cve-2026-1519",
"https://bugzilla.redhat.com/show_bug.cgi?id=2451305",
"https://lists.debian.org/debian-lts-announce/2026/04/msg00008.html",
"https://downloads.isc.org/isc/bind9/9.18.47",
"https://downloads.isc.org/isc/bind9/9.20.21",
"https://downloads.isc.org/isc/bind9/9.21.20"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-1519",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 430853,
"published_at": "2026-03-25T14:16:33.11+00:00"
}