CVE-2026-19630

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU and memory resources without requiring privileges, resulting in a denial of service. In Red Hat Enterprise Linux and OpenShift environments, the risk primarily affects BIND instances functioning as recursive resolvers exposed to untrusted traffic. Deployments serving strictly authoritative roles or those isolated from untrusted client queries experience significantly lower exposure to this attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.