If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries).
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
ISC BIND 9 unaffected
Version Status Constraints
9.11.0 affected ≤ 9.16.50
9.18.0 affected ≤ 9.18.46
9.20.0 affected ≤ 9.20.20
9.21.0 affected ≤ 9.21.19
9.11.3-S1 affected ≤ 9.16.50-S1
9.18.11-S1 affected ≤ 9.18.46-S1
9.20.9-S1 affected ≤ 9.20.20-S1

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Isc Subscribe
Bind Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8124-1 Bind vulnerabilities
Fixes

Solution

Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.47, 9.20.21, 9.21.20, 9.18.47-S1, or 9.20.21-S1.

Workaround

This is not recommended, but disabling DNSSEC (`dnssec-validation no;`) prevents exploitation of this issue.

References
Link Providers
https://downloads.isc.org/isc/bind9/9.18.47 cve-icon cve-icon
https://downloads.isc.org/isc/bind9/9.20.21 cve-icon cve-icon
https://downloads.isc.org/isc/bind9/9.21.20 cve-icon cve-icon
https://kb.isc.org/docs/cve-2026-1519 cve-icon cve-icon
History

Wed, 25 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Description If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
Title Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
First Time appeared Isc
Isc bind
Weaknesses CWE-606
CPEs cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Vendors & Products Isc
Isc bind
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: isc

Published:

Updated: 2026-03-25T14:55:40.032Z

Reserved: 2026-01-28T09:54:49.514Z

Link: CVE-2026-1519

cve-icon Vulnrichment

Updated: 2026-03-25T14:55:35.675Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-25T14:16:33.110

Modified: 2026-03-25T15:41:33.977

Link: CVE-2026-1519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses