CVE-2026-19668

A flaw was found in BIND, a widely used Domain Name System (DNS) software. A remote attacker could exploit this vulnerability by sending a large number of specially crafted, invalid DNSSEC (Domain Name System Security Extensions) records to a BIND recursive resolver. This could lead to excessive resource consumption, resulting in a Denial of Service (DoS) for the affected resolver.

This Moderate impact flaw in BIND recursive resolvers can lead to a denial of service due to excessive resource consumption when processing specific invalid DNSSEC records. Red Hat's default BIND configurations include max-records-per-type and max-types-per-name limits, which help reduce the exposure and prevent a more severe impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate potential denial of service, ensure that the BIND recursive resolver's configuration includes appropriate limits for max-records-per-type and max-types-per-name within the named.conf file. These settings help control resource consumption when encountering invalid DNSSEC records. A restart of the named service is required for any configuration changes to take effect.