CVE-2026-11622

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter

This Important flaw in BIND's DNSSEC-validating resolver can lead to a denial of service. An attacker can trigger excessive memory usage by performing a random subdomain attack against a DNSSEC-signed zone, causing the resolver to exceed its max-cache-size limits. This is critical for Red Hat deployments where BIND is configured for DNSSEC validation and exposed to untrusted query sources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.