CVE-2026-11622: A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send querie

highCVSS 7.5CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-22
Last updated: 2026-07-22
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11622

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-116220.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-11622	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Internet Systems Consortium BIND: Multiple vulnerabilitiescert-bund
unknownDSA-6395-1 bind9 - security updatedebian
highCVE-2026-11622: Potential memory usage beyond configured limitsmsrc

Recent advisories for A DNSSEC validating

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-52688: RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationnvd · 2026-07-23
lowCVE-2026-52686: The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) a…nvd · 2026-07-23
highCVE-2026-11605: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND alway…nvd · 2026-07-22
mediumCVE-2026-50045: 'max-global-quota' reset by DNSSEC validation restartsmsrc · 2026-07-14
highCVE-2026-11605: Unnecessary validation of DNSSEC signed recordsmsrc · 2026-07-14
highCVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Fieldmsrc · 2026-07-14