F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)
F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random (TL-2026-2596) is a high-severity software vulnerability scored CVSS 7.5, first published 2026-09-21. It has no confirmed attribution, affects F5, Inc. BIG-IP DNS, references 1 CVE (CVE-2026-11622), maps to 10 MITRE ATT&CK techniques (T1190, T1499.002, T1499.003), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-2596
- Threat ID
- TL-2026-2596
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-21
- Last reviewed
- 2026-09-21
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 13
F5 BIG-IP DNS versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the BIND 9 DNSSEC-validating resolver affected by CVE-2026-11622, letting a remote, unauthenticated attacker running a random-subdomain attack against a DNSSEC-signed zone drive resolver memory usage orders of magnitude past the configured max-cache-size limit. No F5 patch is available as of the 2026-09-21 advisory; only configuration workarounds exist.
How F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random works
CVE-2026-11622 is a resource-exhaustion flaw (CWE-770, Allocation of Resources Without Limits or Throttling) in the DNSSEC validation path of ISC BIND 9, publicly disclosed by ISC on 2026-07-22 as one of nine BIND CVEs patched together in BIND 9.20.26 and 9.21.24. According to ISC's advisory and the associated BIND engineering issue, a DNSSEC-validating resolver that is subjected to a random-subdomain ("water torture"-style) attack against a DNSSEC-signed zone can be forced into runaway memory growth: if an attacker sends validation queries faster than the resolver can cryptographically validate them, offloaded processing of DNSSEC answers side-steps the resolver's recursive-clients concurrency limit, so pending validation state accumulates without being bounded by the configured max-cache-size. The resolver logs numerous "hung fetch" entries and legitimate cache-hit response times degrade, though the process does not crash outright — the impact is availability-only (CVSS:3.1 C:N/I:N/A:H), scored 7.5/10.0 (High) by ISC, NVD, and Red Hat alike.
F5 confirmed in Security Advisory K000163335 that BIG-IP DNS's optional "Use BIND Server on BIG-IP" DNS-profile setting embeds the vulnerable BIND resolver, exposing BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 to the same flaw when configured as a DNSSEC-validating resolver. As of the 2026-09-21 HKCERT bulletin that surfaced this advisory, F5 has not shipped a fix and instead recommends three interim configuration workarounds: disabling DNSSEC validation in the resolver's DNS cache, switching the DNS profile's cache type to Resolver or Transparent (non-validating) mode, or disabling the "Use BIND Server on BIG-IP" option outright. ISC's own fix ships upstream in BIND 9.20.26 and 9.21.24; there is no evidence F5 has backported it into a BIG-IP hotfix yet.
No public PoC or exploit code was located, and ISC states the flaw was found during internal testing with no confirmed active exploitation or CISA KEV listing as of this writing. The flaw is nonetheless significant for defenders because BIG-IP DNS instances configured as public-facing validating resolvers or GTM/DNS load-balancing tiers are, by design, reachable by arbitrary remote clients — exactly the precondition CVE-2026-11622 requires.
MITRE ATT&CK techniques used in TL-2026-2596
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1499.002 Service Exhaustion Flood; T1499.003 Application Exhaustion Flood; T1499.004 Application or System Exploitation
Resource Development
T1587.004 Exploits; T1588.002 Tool; T1588.006 Vulnerabilities
Reconnaissance
T1590.002 DNS; T1592.002 Software; T1595.002 Vulnerability Scanning
Affected products and versions in F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
- F5, Inc. — BIG-IP DNS
Vulnerable versions: 17.1.0-17.1.3; 17.5.0-17.5.1; 21.1.0 - Internet Systems Consortium (ISC) — BIND 9
Vulnerable versions: 9.11.0-9.18.50; 9.20.0-9.20.24; 9.21.0-9.21.23; 9.11.3-S1-9.18.50-S1 (Supported Preview Edition); 9.20.9-S1-9.20.24-S1 (Supported Preview Edition)
Fixed in: 9.20.26; 9.21.24; 9.20.26-S1
Remediation for F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
Patches
- No F5 patch available as of 2026-09-21 (K000163335)
- Upstream ISC BIND 9.20.26 and 9.21.24 (and 9.20.26-S1 for Supported Preview Edition) fix the underlying flaw, released 2026-07-22
Immediate actions
- Disable DNSSEC validation in the resolver's DNS cache on any BIG-IP DNS profile acting as a validating resolver
- Switch affected DNS profiles from a BIND-backed validating Resolver cache type to Transparent or a non-validating Resolver cache type
- Disable the "Use BIND Server on BIG-IP" option on the DNS profile so BIG-IP DNS no longer invokes the vulnerable embedded BIND resolver
Workarounds
- Disable DNSSEC in the validating resolver's DNS cache
- Switch to Resolver or Transparent cache type
- Disable the "Use BIND Server on BIG-IP" option on the DNS profile
Longer-term hardening
- Apply F5's official BIG-IP DNS patch for CVE-2026-11622 once released under K000163335 (not yet available as of 2026-09-21)
- Track and upgrade any standalone/embedded BIND 9 resolvers referenced by BIG-IP DNS to 9.20.26 or 9.21.24 per ISC guidance once F5 rebases
- Monitor BIG-IP DNS resolver memory utilization, cache size, and recursive-clients / hung-fetch counters for anomalous growth consistent with a random-subdomain attack
CVEs associated with F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
Weaknesses (CWE) in F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
CWE-770
Timeline of F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
- ISC issues early/embargoed vendor notification of CVE-2026-11622 ahead of coordinated public disclosure.
- ISC issues a revised notice to vendors ahead of the public disclosure date.
- ISC publishes kb.isc.org/docs/cve-2026-11622 detailing the runaway memory usage mechanism and CVSS 7.5 (High) rating.
- ISC publicly discloses CVE-2026-11622 alongside eight other BIND 9 CVEs and releases fixed BIND 9.20.26 and 9.21.24.
- Threadlinqs Intelligence opens TL-2026-2596 to track the unpatched F5 BIG-IP DNS exposure.
- HKCERT publishes a High Risk security bulletin flagging F5's advisory for its constituents.
- F5 publishes Security Advisory K000163335 confirming BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the vulnerable BIND resolver via the "Use BIND Server on BIG-IP" option, with no patch yet available and only configuration workarounds offered.
Sources cited for F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random
- F5 BIG-IP Denial of Service Vulnerability - HKCERT Security Bulletin
- F5 Security Advisory K000163335: BIND vulnerability CVE-2026-11622
- ISC Knowledgebase: CVE-2026-11622 - Potential memory usage beyond configured limits
- NVD - CVE-2026-11622 Detail
- [CVE-2026-11622] Runaway memory usage when under random subdomain attack into a DNSSEC-signed domain (Issue #4760)
- ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw
- Red Hat Customer Portal - CVE-2026-11622
- CVE Record - CVE-2026-11622
More in vulnerability
- Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link
- SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild
Detection coverage for TL-2026-2596
As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2596 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.