AZL-93135

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93135.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-93135

Upstream

CVE-2026-11622

Published

2026-07-22T15:16:51Z

Modified

2026-08-28T17:47:39Z

Summary

CVE-2026-11622 affecting package bind for versions less than 9.20.26-1

Details

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the max-cache-size parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-11622

Affected packages

Azure Linux:3 / bind

Package

Name: bind
Purl: pkg:rpm/azure-linux/bind

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.20.26-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-93135.json"