F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)

F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random (TL-2026-2596) is a high-severity software vulnerability scored CVSS 7.5, first published 2026-09-21. It has no confirmed attribution, affects F5, Inc. BIG-IP DNS, references 1 CVE (CVE-2026-11622), maps to 10 MITRE ATT&CK techniques (T1190, T1499.002, T1499.003), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2596

Threat ID
TL-2026-2596
Severity
HIGH
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-21
Last reviewed
2026-09-21
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
13

F5 BIG-IP DNS versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the BIND 9 DNSSEC-validating resolver affected by CVE-2026-11622, letting a remote, unauthenticated attacker running a random-subdomain attack against a DNSSEC-signed zone drive resolver memory usage orders of magnitude past the configured max-cache-size limit. No F5 patch is available as of the 2026-09-21 advisory; only configuration workarounds exist.

How F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random works

CVE-2026-11622 is a resource-exhaustion flaw (CWE-770, Allocation of Resources Without Limits or Throttling) in the DNSSEC validation path of ISC BIND 9, publicly disclosed by ISC on 2026-07-22 as one of nine BIND CVEs patched together in BIND 9.20.26 and 9.21.24. According to ISC's advisory and the associated BIND engineering issue, a DNSSEC-validating resolver that is subjected to a random-subdomain ("water torture"-style) attack against a DNSSEC-signed zone can be forced into runaway memory growth: if an attacker sends validation queries faster than the resolver can cryptographically validate them, offloaded processing of DNSSEC answers side-steps the resolver's recursive-clients concurrency limit, so pending validation state accumulates without being bounded by the configured max-cache-size. The resolver logs numerous "hung fetch" entries and legitimate cache-hit response times degrade, though the process does not crash outright — the impact is availability-only (CVSS:3.1 C:N/I:N/A:H), scored 7.5/10.0 (High) by ISC, NVD, and Red Hat alike.

F5 confirmed in Security Advisory K000163335 that BIG-IP DNS's optional "Use BIND Server on BIG-IP" DNS-profile setting embeds the vulnerable BIND resolver, exposing BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 to the same flaw when configured as a DNSSEC-validating resolver. As of the 2026-09-21 HKCERT bulletin that surfaced this advisory, F5 has not shipped a fix and instead recommends three interim configuration workarounds: disabling DNSSEC validation in the resolver's DNS cache, switching the DNS profile's cache type to Resolver or Transparent (non-validating) mode, or disabling the "Use BIND Server on BIG-IP" option outright. ISC's own fix ships upstream in BIND 9.20.26 and 9.21.24; there is no evidence F5 has backported it into a BIG-IP hotfix yet.

No public PoC or exploit code was located, and ISC states the flaw was found during internal testing with no confirmed active exploitation or CISA KEV listing as of this writing. The flaw is nonetheless significant for defenders because BIG-IP DNS instances configured as public-facing validating resolvers or GTM/DNS load-balancing tiers are, by design, reachable by arbitrary remote clients — exactly the precondition CVE-2026-11622 requires.

MITRE ATT&CK techniques used in TL-2026-2596

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.002 Service Exhaustion Flood; T1499.003 Application Exhaustion Flood; T1499.004 Application or System Exploitation

Resource Development

T1587.004 Exploits; T1588.002 Tool; T1588.006 Vulnerabilities

Reconnaissance

T1590.002 DNS; T1592.002 Software; T1595.002 Vulnerability Scanning

Affected products and versions in F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

  • F5, Inc. — BIG-IP DNS
    Vulnerable versions: 17.1.0-17.1.3; 17.5.0-17.5.1; 21.1.0
  • Internet Systems Consortium (ISC) — BIND 9
    Vulnerable versions: 9.11.0-9.18.50; 9.20.0-9.20.24; 9.21.0-9.21.23; 9.11.3-S1-9.18.50-S1 (Supported Preview Edition); 9.20.9-S1-9.20.24-S1 (Supported Preview Edition)
    Fixed in: 9.20.26; 9.21.24; 9.20.26-S1

Remediation for F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

Patches

  • No F5 patch available as of 2026-09-21 (K000163335)
  • Upstream ISC BIND 9.20.26 and 9.21.24 (and 9.20.26-S1 for Supported Preview Edition) fix the underlying flaw, released 2026-07-22

Immediate actions

  • Disable DNSSEC validation in the resolver's DNS cache on any BIG-IP DNS profile acting as a validating resolver
  • Switch affected DNS profiles from a BIND-backed validating Resolver cache type to Transparent or a non-validating Resolver cache type
  • Disable the "Use BIND Server on BIG-IP" option on the DNS profile so BIG-IP DNS no longer invokes the vulnerable embedded BIND resolver

Workarounds

  • Disable DNSSEC in the validating resolver's DNS cache
  • Switch to Resolver or Transparent cache type
  • Disable the "Use BIND Server on BIG-IP" option on the DNS profile

Longer-term hardening

  • Apply F5's official BIG-IP DNS patch for CVE-2026-11622 once released under K000163335 (not yet available as of 2026-09-21)
  • Track and upgrade any standalone/embedded BIND 9 resolvers referenced by BIG-IP DNS to 9.20.26 or 9.21.24 per ISC guidance once F5 rebases
  • Monitor BIG-IP DNS resolver memory utilization, cache size, and recursive-clients / hung-fetch counters for anomalous growth consistent with a random-subdomain attack

CVEs associated with F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

CVE-2026-11622

Weaknesses (CWE) in F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

CWE-770

Timeline of F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

  • ISC issues early/embargoed vendor notification of CVE-2026-11622 ahead of coordinated public disclosure.
  • ISC issues a revised notice to vendors ahead of the public disclosure date.
  • ISC publishes kb.isc.org/docs/cve-2026-11622 detailing the runaway memory usage mechanism and CVSS 7.5 (High) rating.
  • ISC publicly discloses CVE-2026-11622 alongside eight other BIND 9 CVEs and releases fixed BIND 9.20.26 and 9.21.24.
  • Threadlinqs Intelligence opens TL-2026-2596 to track the unpatched F5 BIG-IP DNS exposure.
  • HKCERT publishes a High Risk security bulletin flagging F5's advisory for its constituents.
  • F5 publishes Security Advisory K000163335 confirming BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the vulnerable BIND resolver via the "Use BIND Server on BIG-IP" option, with no patch yet available and only configuration workarounds offered.

Sources cited for F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random

More in vulnerability

Detection coverage for TL-2026-2596

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2596 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats