CVE-2026-11622CWE-770

Potential memory usage beyond configured limits

High · published July 22, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter.

This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00542 · 44.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-22T14:12Z
EPSS history
Timeline
  • 22 JUL 14:12Z
    Potential memory usage beyond configured limits
    cvelistv5