Critical Denial of Service Vulnerability in BIND 9.18 - CVE-2026-1519
Summary
RLSA-2026:7915: Important: bind9.18 security update. Affects bind9.18 versions < 2:9.18.29-5.el9_7.4. Fixed in 2:9.18.29-5.el9_7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves hostnames to IP addresses, a resolver library for application interfacing with DNS, and various tools for DNS server verification. BIND 9.18 is a specific version that has been identified to have a critical vulnerability that could lead to service disruption.
Vulnerability Detail
The vulnerability identified as CVE-2026-1519 allows for a Denial of Service (DoS) attack through maliciously crafted DNSSEC-validated zones. An attacker can exploit this vulnerability to disrupt the normal operation of the DNS server, potentially leading to service outages and affecting all services reliant on DNS resolution. The vulnerability has a CVSS score of 7.5, indicating its severity and the potential impact on affected systems.
How To Fix
Minimum fixed version
2:9.18.29-5.el9_7.4
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable DNSSEC validation in your BIND configuration. However, this is not recommended as a long-term solution. To disable DNSSEC, edit the named.conf file and set 'dnssec-validation no;'. Remember to restart the BIND service after making changes.
Conclusion
The vulnerability CVE-2026-1519 in BIND 9.18 poses a significant risk of Denial of Service attacks. It is crucial to update to the patched version to ensure the security and reliability of DNS services. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for bind9.18 →
FAQ
CVE-2026-1519 is a critical vulnerability in BIND 9.18 that allows for Denial of Service attacks via malicious DNSSEC-validated zones.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to service outages, affecting all applications and services that rely on DNS resolution.
Yes, a patched version of BIND is available. You should update to version 2:9.18.29-5.el9_7.4 to mitigate the risk.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, helping you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
