CVE-2026-1519
CVE-2026-1519 · Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
CVSS 7.5 · High · EPSS 1.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
bind 9
- Versions
- ≥ 9.11.0, ≤ 9.16.50: Affected (custom)
- ≥ 9.18.0, ≤ 9.18.46: Affected (custom)
- ≥ 9.20.0, ≤ 9.20.20: Affected (custom)
- ≥ 9.21.0, ≤ 9.21.19: Affected (custom)
- ≥ 9.11.3-S1, ≤ 9.16.50-S1: Affected (custom)
- ≥ 9.18.11-S1, ≤ 9.18.46-S1: Affected (custom)
- ≥ 9.20.9-S1, ≤ 9.20.20-S1: Affected (custom)
No fix published
bind9 Debian:12
- Versions
- 1:9.18.12-1
- 1:9.18.13-1
- 1:9.18.16-1
- 1:9.18.16-1~deb12u1
- 1:9.18.16-1~deb12u1~bpo11+1
- 1:9.18.19-1~deb12u1
- 1:9.18.19-1~deb12u1~bpo11+1
- 1:9.18.24-1
- 1:9.18.24-1~bpo11+1
- 1:9.18.28-1~deb12u1
- 1:9.18.28-1~deb12u2
- 1:9.18.33-1~deb12u2
- 1:9.18.41-1~deb12u1
- 1:9.18.44-1~deb12u1
- Affected ranges
- ECOSYSTEM: < 1:9.18.47-1~deb12u1
Update to 1:9.18.47-1~deb12u1
bind9 Debian:13
- Versions
- 1:9.20.11-4
- 1:9.20.15-1
- 1:9.20.15-1~deb13u1
- 1:9.20.15-1~deb13u1~bpo12+1
- 1:9.20.15-2
- 1:9.20.18-1
- 1:9.20.18-1~deb13u1
- 1:9.20.18-1~deb13u1~bpo12+1
- 1:9.20.19-1
- 1:9.20.19-1~bpo12+1
- 1:9.20.20-1
- 1:9.20.20-1~bpo12+1
- 1:9.20.21-1~deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 1:9.20.21-1~deb13u1
Update to 1:9.20.21-1~deb13u1
bind9 Debian:14
- Versions
- 1:9.20.11-4
- 1:9.20.15-1
- 1:9.20.15-1~deb13u1
- 1:9.20.15-1~deb13u1~bpo12+1
- 1:9.20.15-2
- 1:9.20.18-1
- 1:9.20.18-1~deb13u1
- 1:9.20.18-1~deb13u1~bpo12+1
- 1:9.20.19-1
- 1:9.20.19-1~bpo12+1
- 1:9.20.20-1
- 1:9.20.20-1~bpo12+1
- 1:9.20.21-1~deb13u1
- 1:9.20.21-1~deb13u1~bpo12+1
- Affected ranges
- ECOSYSTEM: < 1:9.20.21-1
Update to 1:9.20.21-1
bind9 Ubuntu:Pro:14.04:LTS
- Versions
- 1:9.9.3.dfsg.P2-4ubuntu1
- 1:9.9.3.dfsg.P2-4ubuntu2
- 1:9.9.3.dfsg.P2-4ubuntu3
- 1:9.9.5.dfsg-2
- 1:9.9.5.dfsg-3
- 1:9.9.5.dfsg-3ubuntu0.1
- 1:9.9.5.dfsg-3ubuntu0.2
- 1:9.9.5.dfsg-3ubuntu0.3
- 1:9.9.5.dfsg-3ubuntu0.4
- 1:9.9.5.dfsg-3ubuntu0.5
- 1:9.9.5.dfsg-3ubuntu0.6
- 1:9.9.5.dfsg-3ubuntu0.7
- 1:9.9.5.dfsg-3ubuntu0.8
- 1:9.9.5.dfsg-3ubuntu0.9
- 1:9.9.5.dfsg-3ubuntu0.10
- 1:9.9.5.dfsg-3ubuntu0.11
- 1:9.9.5.dfsg-3ubuntu0.12
- 1:9.9.5.dfsg-3ubuntu0.13
- 1:9.9.5.dfsg-3ubuntu0.14
- 1:9.9.5.dfsg-3ubuntu0.15
- 1:9.9.5.dfsg-3ubuntu0.16
- 1:9.9.5.dfsg-3ubuntu0.17
- 1:9.9.5.dfsg-3ubuntu0.18
- 1:9.9.5.dfsg-3ubuntu0.19
- 1:9.9.5.dfsg-3ubuntu0.19+esm1
- 1:9.9.5.dfsg-3ubuntu0.19+esm2
- 1:9.9.5.dfsg-3ubuntu0.19+esm3
- 1:9.9.5.dfsg-3ubuntu0.19+esm4
- 1:9.9.5.dfsg-3ubuntu0.19+esm5
- 1:9.9.5.dfsg-3ubuntu0.19+esm6
- 1:9.9.5.dfsg-3ubuntu0.19+esm7
- 1:9.9.5.dfsg-3ubuntu0.19+esm9
- 1:9.9.5.dfsg-3ubuntu0.19+esm10
- 1:9.9.5.dfsg-3ubuntu0.19+esm11
- 1:9.9.5.dfsg-3ubuntu0.19+esm12
- 1:9.9.5.dfsg-3ubuntu0.19+esm13
- 1:9.9.5.dfsg-3ubuntu0.19+esm14
- Affected ranges
- ECOSYSTEM: < 1:9.9.5.dfsg-3ubuntu0.19+esm15
Update to 1:9.9.5.dfsg-3ubuntu0.19+esm15
bind9 Ubuntu:Pro:16.04:LTS
- Versions
- 1:9.9.5.dfsg-11ubuntu1
- 1:9.9.5.dfsg-12
- 1:9.9.5.dfsg-12.1
- 1:9.9.5.dfsg-12.1ubuntu1
- 1:9.10.3.dfsg.P2-4
- 1:9.10.3.dfsg.P2-5
- 1:9.10.3.dfsg.P4-3
- 1:9.10.3.dfsg.P4-4
- 1:9.10.3.dfsg.P4-5
- 1:9.10.3.dfsg.P4-8
- 1:9.10.3.dfsg.P4-8ubuntu1
- 1:9.10.3.dfsg.P4-8ubuntu1.1
- 1:9.10.3.dfsg.P4-8ubuntu1.2
- 1:9.10.3.dfsg.P4-8ubuntu1.3
- 1:9.10.3.dfsg.P4-8ubuntu1.4
- 1:9.10.3.dfsg.P4-8ubuntu1.5
- 1:9.10.3.dfsg.P4-8ubuntu1.6
- 1:9.10.3.dfsg.P4-8ubuntu1.7
- 1:9.10.3.dfsg.P4-8ubuntu1.8
- 1:9.10.3.dfsg.P4-8ubuntu1.9
- 1:9.10.3.dfsg.P4-8ubuntu1.10
- 1:9.10.3.dfsg.P4-8ubuntu1.11
- 1:9.10.3.dfsg.P4-8ubuntu1.12
- 1:9.10.3.dfsg.P4-8ubuntu1.14
- 1:9.10.3.dfsg.P4-8ubuntu1.15
- 1:9.10.3.dfsg.P4-8ubuntu1.16
- 1:9.10.3.dfsg.P4-8ubuntu1.17
- 1:9.10.3.dfsg.P4-8ubuntu1.18
- 1:9.10.3.dfsg.P4-8ubuntu1.19
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm1
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm2
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm3
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm5
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm6
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm7
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm9
- 1:9.10.3.dfsg.P4-8ubuntu1.19+esm10
- Affected ranges
- ECOSYSTEM: < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
Update to 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11
bind9 Ubuntu:Pro:18.04:LTS
- Versions
- 1:9.10.3.dfsg.P4-12.6ubuntu1
- 1:9.11.2.P1-1ubuntu2
- 1:9.11.2.P1-1ubuntu3
- 1:9.11.2.P1-1ubuntu4
- 1:9.11.2.P1-1ubuntu5
- 1:9.11.3+dfsg-1ubuntu1
- 1:9.11.3+dfsg-1ubuntu1.1
- 1:9.11.3+dfsg-1ubuntu1.2
- 1:9.11.3+dfsg-1ubuntu1.3
- 1:9.11.3+dfsg-1ubuntu1.5
- 1:9.11.3+dfsg-1ubuntu1.7
- 1:9.11.3+dfsg-1ubuntu1.8
- 1:9.11.3+dfsg-1ubuntu1.9
- 1:9.11.3+dfsg-1ubuntu1.10
- 1:9.11.3+dfsg-1ubuntu1.11
- 1:9.11.3+dfsg-1ubuntu1.12
- 1:9.11.3+dfsg-1ubuntu1.13
- 1:9.11.3+dfsg-1ubuntu1.14
- 1:9.11.3+dfsg-1ubuntu1.15
- 1:9.11.3+dfsg-1ubuntu1.16
- 1:9.11.3+dfsg-1ubuntu1.17
- 1:9.11.3+dfsg-1ubuntu1.18
- 1:9.11.3+dfsg-1ubuntu1.19+esm1
- 1:9.11.3+dfsg-1ubuntu1.19+esm2
- 1:9.11.3+dfsg-1ubuntu1.19+esm3
- 1:9.11.3+dfsg-1ubuntu1.19+esm4
- 1:9.11.3+dfsg-1ubuntu1.19+esm5
- Affected ranges
- ECOSYSTEM: < 1:9.11.3+dfsg-1ubuntu1.19+esm6
Update to 1:9.11.3+dfsg-1ubuntu1.19+esm6
isc-dhcp Ubuntu:18.04:LTS
- Versions
- 4.3.5-3ubuntu2
- 4.3.5-3ubuntu3
- 4.3.5-3ubuntu4
- 4.3.5-3ubuntu5
- 4.3.5-3ubuntu6
- 4.3.5-3ubuntu7
- 4.3.5-3ubuntu7.1
- 4.3.5-3ubuntu7.2
- 4.3.5-3ubuntu7.3
- 4.3.5-3ubuntu7.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bind9 Ubuntu:Pro:20.04:LTS
- Versions
- 1:9.11.5.P4+dfsg-5.1ubuntu2
- 1:9.11.5.P4+dfsg-5.1ubuntu3
- 1:9.11.5.P4+dfsg-5.1ubuntu4
- 1:9.11.5.P4+dfsg-5.1ubuntu5
- 1:9.11.14+dfsg-1ubuntu1
- 1:9.11.14+dfsg-3ubuntu1
- 1:9.16.0-1ubuntu3
- 1:9.16.0-1ubuntu4
- 1:9.16.0-1ubuntu5
- 1:9.16.1-0ubuntu1
- 1:9.16.1-0ubuntu2
- 1:9.16.1-0ubuntu2.1
- 1:9.16.1-0ubuntu2.2
- 1:9.16.1-0ubuntu2.3
- 1:9.16.1-0ubuntu2.4
- 1:9.16.1-0ubuntu2.6
- 1:9.16.1-0ubuntu2.7
- 1:9.16.1-0ubuntu2.8
- 1:9.16.1-0ubuntu2.9
- 1:9.16.1-0ubuntu2.10
- 1:9.16.1-0ubuntu2.11
- 1:9.16.1-0ubuntu2.12
- 1:9.16.1-0ubuntu2.14
- 1:9.16.1-0ubuntu2.15
- 1:9.16.1-0ubuntu2.16
- 1:9.16.48-0ubuntu0.20.04.1
- 1:9.18.28-0ubuntu0.20.04.1
- 1:9.18.30-0ubuntu0.20.04.1
- 1:9.18.30-0ubuntu0.20.04.2
- 1:9.18.30-0ubuntu0.20.04.2+esm1
- 1:9.18.30-0ubuntu0.20.04.2+esm2
- Affected ranges
- ECOSYSTEM: < 1:9.18.30-0ubuntu0.20.04.2+esm3
Update to 1:9.18.30-0ubuntu0.20.04.2+esm3
bind9-libs Ubuntu:20.04:LTS
- Versions
- 1:9.11.16+dfsg-3~build1
- 1:9.11.16+dfsg-3~ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bind9 Ubuntu:22.04:LTS
- Versions
- 1:9.16.15-1ubuntu1
- 1:9.16.15-1ubuntu2
- 1:9.16.15-1ubuntu3
- 1:9.18.0-2ubuntu1
- 1:9.18.0-2ubuntu2
- 1:9.18.0-2ubuntu3
- 1:9.18.1-1ubuntu1
- 1:9.18.1-1ubuntu1.1
- 1:9.18.1-1ubuntu1.2
- 1:9.18.1-1ubuntu1.3
- 1:9.18.12-0ubuntu0.22.04.1
- 1:9.18.12-0ubuntu0.22.04.2
- 1:9.18.12-0ubuntu0.22.04.3
- 1:9.18.18-0ubuntu0.22.04.1
- 1:9.18.18-0ubuntu0.22.04.2
- 1:9.18.24-0ubuntu0.22.04.1
- 1:9.18.28-0ubuntu0.22.04.1
- 1:9.18.30-0ubuntu0.22.04.1
- 1:9.18.30-0ubuntu0.22.04.2
- 1:9.18.39-0ubuntu0.22.04.1
- 1:9.18.39-0ubuntu0.22.04.2
- Affected ranges
- ECOSYSTEM: < 1:9.18.39-0ubuntu0.22.04.3
Update to 1:9.18.39-0ubuntu0.22.04.3
bind9-libs Ubuntu:22.04:LTS
- Versions
- 1:9.11.19+dfsg-2.1ubuntu1
- 1:9.11.19+dfsg-2.1ubuntu2
- 1:9.11.19+dfsg-2.1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bind9 Ubuntu:24.04:LTS
- Versions
- 1:9.18.18-0ubuntu2
- 1:9.18.21-0ubuntu1
- 1:9.18.24-0ubuntu3
- 1:9.18.24-0ubuntu4
- 1:9.18.24-0ubuntu5
- 1:9.18.28-0ubuntu0.24.04.1
- 1:9.18.30-0ubuntu0.24.04.1
- 1:9.18.30-0ubuntu0.24.04.2
- 1:9.18.39-0ubuntu0.24.04.1
- 1:9.18.39-0ubuntu0.24.04.2
- Affected ranges
- ECOSYSTEM: < 1:9.18.39-0ubuntu0.24.04.3
Update to 1:9.18.39-0ubuntu0.24.04.3
isc-dhcp Ubuntu:24.04:LTS
- Versions
- 4.4.3-P1-2ubuntu5
- 4.4.3-P1-4ubuntu1
- 4.4.3-P1-4ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
bind9 Ubuntu:25.10
- Versions
- 1:9.20.4-3ubuntu1
- 1:9.20.4-3ubuntu2
- 1:9.20.4-3ubuntu3
- 1:9.20.9-2ubuntu1
- 1:9.20.10-1ubuntu1
- 1:9.20.11-1ubuntu1
- 1:9.20.11-1ubuntu2
- 1:9.20.11-1ubuntu2.1
- Affected ranges
- ECOSYSTEM: < 1:9.20.11-1ubuntu2.2
Update to 1:9.20.11-1ubuntu2.2
isc-dhcp Ubuntu:25.10
- Versions
- 4.4.3-P1-4ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
isc-dhcp Ubuntu:26.04:LTS
- Versions
- 4.4.3-P1-4ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://kb.isc.org/docs/cve-2026-1519
- https://downloads.isc.org/isc/bind9/9.18.47
- https://downloads.isc.org/isc/bind9/9.20.21
- https://downloads.isc.org/isc/bind9/9.21.20
- https://lists.debian.org/debian-lts-announce/2026/04/msg00008.html
- https://access.redhat.com/security/cve/CVE-2026-1519
- https://bugzilla.redhat.com/show_bug.cgi?id=2451305
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1519.json
- https://access.redhat.com/errata/RHSA-2026:11372
- https://access.redhat.com/errata/RHSA-2026:11371
- https://access.redhat.com/errata/RHSA-2026:34048
- https://access.redhat.com/errata/RHSA-2026:40021
- https://access.redhat.com/errata/RHSA-2026:36610
- https://access.redhat.com/errata/RHSA-2026:43226
- https://access.redhat.com/errata/RHSA-2026:62549
- https://access.redhat.com/errata/RHSA-2026:60019
- https://access.redhat.com/errata/RHSA-2026:65851
- https://access.redhat.com/errata/RHSA-2026:29863
- https://access.redhat.com/errata/RHSA-2026:24851
- https://access.redhat.com/errata/RHSA-2026:8312
- https://access.redhat.com/errata/RHSA-2026:8352
- https://access.redhat.com/errata/RHSA-2026:8155
- https://access.redhat.com/errata/RHSA-2026:16064
- https://nvd.nist.gov/vuln/detail/CVE-2026-1519