CVE-2026-11622
Publication date 22 July 2026
Last updated 17 October 2026
Ubuntu priority
Description
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| bind9 | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Fixed in 1:9.20.24-1ubuntu0.2
|
|
| 24.04 LTS noble |
Fixed in 1:9.18.39-0ubuntu0.24.04.6
|
|
| 22.04 LTS jammy |
Fixed in 1:9.18.39-0ubuntu0.22.04.5
|
|
| 20.04 LTS focal |
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
|
|
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored changes too intrusive | |
| 14.04 LTS trusty | Ignored changes too intrusive | |
| isc-dhcp | 26.10 stonking | Not in release |
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
|
| bind9-libs | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
alexmurray
As of isc-dhcp-4.4.3-1, isc-dhcp vendors bind9 libs
mdeslaur
in focal and jammy, isc-dhcp uses the bind9-libs package This is unlikely to affect isc-dhcp's use of bind9-libs and the vendored bind9 libs, marking as negligible
john-breton
The fix adds a reference count to every rdataset header. On bionic and xenial that changes the on-disk layout of map-format zone files, so after an upgrade named would refuse existing map files (or crash on them without a format version bump). Not fixed on bionic and xenial to avoid that, nor on the older trusty.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8648-1
- Bind vulnerabilities
- 19 August 2026
- USN-8929-1
- Bind vulnerabilities
- 14 October 2026