CVE-2026-19668

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-407

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ISCBIND 9>= 9.11.0, <= 9.18.50; >= 9.20.0, <= 9.20.27; >= 9.21.0, <= 9.21.25; >= 9.11.3-S1, <= 9.18.50-S1; >= 9.20.9-S1, <= 9.20.27-S1

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-196697.8The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_hanCVE-2026-196705.4Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htaCVE-2026-196716.5Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when CVE-2026-196726.3The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destinaCVE-2026-196737.1ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct CVE-2026-196767.8The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device CVE-2026-196779.3An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attaCVE-2026-196788.7A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unautheCVE-2026-196798.8An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames coCVE-2026-196807.1A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's dataCVE-2026-196819.9An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit thisCVE-2026-196829.9A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arb