CVE-2026-11622: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-11622 is a denial-of-service vulnerability in ISC BIND 9 affecting its DNSSEC validating resolver, where a random subdomain ("NXDOMAIN") attack against a DNSSEC-signed zone can cause runaway memory consumption far exceeding the configured max-cache-size limit. Disclosed on July 22, 2026, it affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and the corresponding Subscription Edition branches (9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1). It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). When a DNSSEC-validating resolver receives a flood of queries for random, non-existent subdomains of a DNSSEC-signed zone, it must perform cryptographic validation for each query before it can cache a negative response. If the attacker can submit queries faster than the resolver completes validation, pending validation state accumulates in memory without bound, bypassing the max-cache-size configuration parameter by orders of magnitude. No authentication or special privileges are required; the attack vector is purely network-based (GitHub Advisory, ISC KB).

Successful exploitation results in a complete availability impact on the affected BIND 9 resolver — memory exhaustion can cause the named process to crash or become unresponsive, disrupting DNS resolution for all clients relying on that resolver. There is no confidentiality or integrity impact. Organizations running BIND as a recursive resolver for internal networks or public-facing infrastructure face potential widespread DNS outages, which could indirectly enable further attacks by disrupting security controls that depend on DNS (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure. The attack is automatable (NVD SSVC: automatable=yes) and requires no authentication, making it accessible to any network-capable attacker who can generate high-volume DNS query traffic. The EPSS score is approximately 0.86%, indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, ISC KB).

1. Reconnaissance: Identify target BIND 9 resolvers running affected versions (9.11.0–9.18.50, 9.20.0–9.20.24, 9.21.0–9.21.23) that perform DNSSEC validation, using tools such as dig with the +dnssec flag or network scanning.
2. Identify a DNSSEC-signed target zone: Select or control a DNSSEC-signed zone (or target queries at an existing signed zone) that the resolver will attempt to validate.
3. Generate random subdomain queries: Use a high-throughput DNS query tool (e.g., dnsperf, flamethrower, or custom scripts) to flood the resolver with queries for randomly generated, non-existent subdomains of the DNSSEC-signed zone (e.g., <random>.example-signed.com).
4. Sustain query rate above validation throughput: Maintain a query rate that exceeds the resolver's DNSSEC validation capacity, causing pending validation state to accumulate in memory without being bounded by max-cache-size.
5. Achieve denial of service: As memory consumption grows orders of magnitude beyond configured limits, the named process exhausts available system memory, leading to a crash or OOM-kill, rendering the resolver unavailable (ISC KB, GitHub Advisory).

• Network: High-volume DNS queries for randomly generated, non-existent subdomains of a DNSSEC-signed zone arriving from one or more source IPs; unusual spike in NXDOMAIN responses from the resolver.
• Logs: BIND query logs (/var/log/named/ or syslog) showing a flood of queries for random subdomains of the same parent zone; repeated SERVFAIL or NXDOMAIN responses at abnormal rates; BIND log messages indicating memory pressure or allocation failures.
• Process/System: Rapid, sustained growth in the named process's RSS/VSZ memory (observable via top, ps, or monitoring tools); OOM-killer events in /var/log/kern.log or dmesg referencing named; unexpected named process crash or restart.
• File System: Core dump files generated by named in the working directory (e.g., /var/named/) following a crash.

ISC has released patched versions BIND 9.20.26 and 9.21.24 that address this vulnerability; users should upgrade to these or later releases (ISC Downloads, ISC KB). As interim mitigations, administrators should implement DNS query rate limiting (QRL) using BIND's rate-limit configuration block to throttle queries from untrusted sources, and monitor memory usage on DNSSEC-validating resolvers with alerts for rapid consumption. Linux distribution vendors including SUSE, openSUSE, Debian, Amazon Linux, and Alpine Linux have issued updated packages (SUSE Advisory).

Security media noted that ISC released nine CVEs in its July 2026 BIND update cycle, with commentary attributing the increased patch cadence partly to LLM-assisted code auditing (TechTimes). Security news outlets such as SecurityOnline.info covered the batch of BIND DNSSEC vulnerabilities, and the disclosure was discussed on the oss-security mailing list (oss-sec). Downstream Linux distributions responded promptly with updated packages, reflecting the high operational impact of BIND vulnerabilities on internet infrastructure.