ISC BIND 9 resolver inbound DNS message name-compression resource exhaustion

CVE-2026-19630 is an algorithmic complexity flaw (CWE-407) in ISC BIND 9's DNS message parser. When named receives a DNS message containing an excessive number of compressed name pointers, it expands every one of them without any imposed resource bound. A single crafted message can force the process to burn disproportionate CPU and memory expanding names, and a modest stream of such messages saturates all worker threads, causing legitimate DNS queries to time out. The affected range is enormous: BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26 — essentially every BIND 9 release shipped in the past decade. Fixed versions are 9.20.30, 9.21.27, and 9.20.30-S1. No workaround exists; the fix adds a hard cap on per-message name expansion and returns FORMERR when the limit is exceeded.

ISC rates this HIGH at CVSS 7.5 and that assessment is accurate. The attack vector is network/unauthenticated/low-complexity/no-interaction — the worst possible access profile. The saving grace is that the impact ceiling is availability only: no code execution, no data leak, no persistence. ISC discovered the flaw internally and states it is aware of no active exploitation. Still, the asymmetric cost (attacker sends kilobytes, server burns CPU seconds) and the critical role of DNS resolvers in every enterprise make this a serious operational risk. For a fleet of 10,000 hosts, losing your primary DNS resolver means AD auth, email, web services, and basically every network-dependent process grinds to a halt until the attack stops or the service restarts.

Sources.

1. ISC Advisory — CVE-2026-19630
2. BIND 9.21.27 Release Notes
3. Security Online — ISC Patches Four BIND 9 Flaws
4. Canadian Centre for Cyber Security — AV26-1072
5. Red Hat RHSA-2026:75767
6. CVEFeed — CVE-2026-19630 Detail
7. Cyberpress — 706K BIND Resolvers Exposed (Censys)

Run this script on each host running BIND (named). No root required — it calls named -v which is world-executable. Example: chmod +x check_cve_2026_19630.sh && ./check_cve_2026_19630.sh. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# CVE-2026-19630 — ISC BIND name-compression resource exhaustion
# Checks installed BIND version against fixed releases.
# Exit: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -uo pipefail

if ! command -v named &>/dev/null; then
  echo "UNKNOWN — 'named' not found in PATH; BIND may not be installed."
  exit 2
fi

RAW=$(named -v 2>&1 || true)
# Strip Preview Edition -S suffix for version comparison
CLEAN=$(echo "$RAW" | sed 's/-S[0-9]*//')
VER=$(echo "$CLEAN" | grep -oP '\d+\.\d+\.\d+' | head -1)

if [[ -z "$VER" ]]; then
  echo "UNKNOWN — could not parse BIND version from: $RAW"
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VER"
echo "Detected: $RAW  (parsed: $MAJOR.$MINOR.$PATCH)"

if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — not BIND 9 (major=$MAJOR). Check ISC advisory manually."
  exit 2
fi

if [[ "$MINOR" -ge 11 && "$MINOR" -le 18 ]]; then
  echo "VULNERABLE — BIND 9.${MINOR}.${PATCH} is in the 9.11-9.18 range (EOL, no fix). Migrate to >=9.20.30."
  exit 1
elif [[ "$MINOR" -eq 19 ]]; then
  echo "VULNERABLE — BIND 9.19.x dev branch predates fixed 9.20. Upgrade to >=9.20.30."
  exit 1
elif [[ "$MINOR" -eq 20 ]]; then
  if [[ "$PATCH" -ge 30 ]]; then
    echo "PATCHED — BIND 9.20.${PATCH} >= 9.20.30."
    exit 0
  else
    echo "VULNERABLE — BIND 9.20.${PATCH} < 9.20.30."
    exit 1
  fi
elif [[ "$MINOR" -eq 21 ]]; then
  if [[ "$PATCH" -ge 27 ]]; then
    echo "PATCHED — BIND 9.21.${PATCH} >= 9.21.27."
    exit 0
  else
    echo "VULNERABLE — BIND 9.21.${PATCH} < 9.21.27."
    exit 1
  fi
elif [[ "$MINOR" -lt 11 ]]; then
  echo "PATCHED — BIND 9.${MINOR}.x is below the affected range (starts at 9.11.0)."
  exit 0
else
  # 9.22+ or future branches
  echo "UNKNOWN — BIND 9.${MINOR}.x not in advisory scope. Consult ISC KB."
  exit 2
fi