Threat reportVulnerabilityTL-2026-2596

F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)

highACTIVE

F5 BIG-IP DNS versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the BIND 9 DNSSEC-validating resolver affected by CVE-2026-11622, letting a remote, unauthenticated attacker running a random-subdomain attack against a DNSSEC-signed zone drive resolver memory usage orders of magnitude past the configured max-cache-size limit.

Key facts for F5 BIG-IP DNS BIND DoS

Identifiers	TL-2026-2596, CVE-2026-11622
Severity	HIGH
CVSS	7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Exploitation status	No exploitation observed (theoretical)
EPSS	CVE-2026-11622: 0.5% (43.3th percentile)
Affected products	F5, Inc. BIG-IP DNS; Internet Systems Consortium (ISC) BIND 9
Weaknesses (CWE)	CWE-770
MITRE ATT&CK techniques	T1190 Exploit Public-Facing Application, T1499.002 Service Exhaustion Flood, T1499.003 Application Exhaustion Flood, T1499.004 Application or System Exploitation, T1587.004 Exploits, T1588.002 Tool, T1588.006 Vulnerabilities, T1590.002 DNS, T1592.002 Software, T1595.002 Vulnerability Scanning
Motivation	UNKNOWN
Detection rules	9 (1 shown free)
Sources	8 cited sources

Detection coverage for F5 BIG-IP DNS BIND DoS

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2596 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone (CVE-2026-11622)

Detects a high-cardinality burst of pseudo-random, low-TTL subdomain queries against a DNSSEC-signed zone served or resolved by BIG-IP DNS. This is the initial-access exploitation pattern for CVE-2026-11622: an attacker sends validation queries for nonexistent random labels faster than the embedded BIND resolver's offloaded DNSSEC-validation path can process them, starting the runaway memory-growth condition before recursive-clients concurrency limits or max-cache-size can bound it.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1190, T1499.002, T1499.003
Data sources: f5_bigip_dns_query_logs, bind_named_query_log, dns_analytics
Severity: high
Confidence: high

Splunk SPL

index=network (sourcetype="f5:bigip:dns" OR sourcetype="f5:bigip:syslog" OR sourcetype="bind:query" OR sourcetype="infoblox:dns")
| rex field=query "^(?<label>[a-zA-Z0-9]{8,32})\.(?<queried_zone>[a-zA-Z0-9.\-]+)$"
| eval is_nxdomain=if(match(rcode, "(?i)NXDOMAIN") OR match(reply_code, "(?i)NXDOMAIN"), 1, 0)
| where is_nxdomain=1 AND isnotnull(label)
| bucket _time span=1m
| stats dc(query) AS unique_random_subdomains, count AS total_nxdomain_queries, dc(src_ip) AS unique_source_ips, values(src_ip) AS sample_src_ips BY queried_zone, _time
| where queried_zone IN ("<dnssec_signed_zone_1>", "<dnssec_signed_zone_2>") AND unique_random_subdomains > 1000
| sort - unique_random_subdomains
| table _time queried_zone unique_random_subdomains total_nxdomain_queries unique_source_ips sample_src_ips

Microsoft KQL

let DNSSECZones = dynamic(["<dnssec_signed_zone_1>", "<dnssec_signed_zone_2>"]);
DnsEvents
| where TimeGenerated > ago(1h)
| where ResponseCodeName =~ "NXDOMAIN"
| extend QueryZone = extract(@"([a-zA-Z0-9.\-]+\.[a-zA-Z]{2,})$", 1, Name)
| where QueryZone in (DNSSECZones)
| where Name matches regex @"^[a-zA-Z0-9]{8,32}\."
| summarize UniqueRandomSubdomains = dcount(Name), TotalNxdomainQueries = count(), UniqueSourceIPs = dcount(ClientIP) by QueryZone, bin(TimeGenerated, 1m)
| where UniqueRandomSubdomains > 1000
| project TimeGenerated, QueryZone, UniqueRandomSubdomains, TotalNxdomainQueries, UniqueSourceIPs
| order by UniqueRandomSubdomains desc

Sigma

title: Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone
id: 8b1e2c4a-6f3d-4a91-9c2e-1a2f5e7d8b01
status: experimental
description: Detects a burst of pseudo-random NXDOMAIN subdomain queries against a DNSSEC-signed zone, the exploitation trigger for CVE-2026-11622 against F5 BIG-IP DNS / ISC BIND DNSSEC-validating resolvers.
references:
    - https://kb.isc.org/docs/cve-2026-11622
    - https://my.f5.com/manage/s/article/K000163335
    - https://www.hkcert.org/security-bulletin/f5-big-ip-denial-of-service-vulnerability_20260921
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.reconnaissance
    - attack.t1190
    - attack.impact
    - attack.t1499.002
    - attack.t1499.003
    - cve.2026.11622
    - cwe.770
logsource:
    category: dns
    product: dns
detection:
    selection:
        answer_code: 'NXDOMAIN'
    filter_zone:
        query|endswith:
            - '.<dnssec_signed_zone_1>'
            - '.<dnssec_signed_zone_2>'
    filter_random_label:
        query|re: '^[a-zA-Z0-9]{8,32}\.'
    condition: selection and filter_zone and filter_random_label | count(query) by src_ip > 1000
    timeframe: 1m
falsepositives:
    - Legitimate DNS cache-busting or CDN health-check traffic using randomized subdomains
    - Aggressive third-party security scanners performing subdomain enumeration against the same DNSSEC-signed zone
level: high

Known false positives:

Legitimate CDN/anti-cache random-subdomain health checks or A/B routing against the same zone
Authorized subdomain-enumeration or DNSSEC-validation load testing

Tuning notes: Populate the DNSSEC-signed zone allowlist from the org's actual signed zones served by BIG-IP DNS/GTM. Raise the 1000/min unique-subdomain threshold in environments with legitimately high cache-miss DNS churn (e.g. large CDNs), and correlate against src_ip diversity (see SPL-003/KQL-003/SIG-003) to separate single-source abuse from distributed flood.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone (CVE-2026-11622) · unlock with TL Creds
BIND Resolver Hung-Fetch & max-cache-size Breach on BIG-IP DNS (Post-Exploitation Resource Exhaustion) · unlock with TL Creds
Distributed Water-Torture Sourcing & BIND-Version Recon Fingerprinting Against BIG-IP DNS · unlock with TL Creds
Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone (CVE-2026-11622) · unlock with TL Creds
BIND Resolver Hung-Fetch & max-cache-size Breach on BIG-IP DNS (Post-Exploitation Resource Exhaustion) · unlock with TL Creds
Distributed Water-Torture Sourcing & BIND-Version Recon Fingerprinting Against BIG-IP DNS · unlock with TL Creds
BIND Resolver Hung-Fetch & max-cache-size Breach on BIG-IP DNS (Post-Exploitation Resource Exhaustion) · unlock with TL Creds
Distributed Water-Torture Sourcing & BIND-Version Recon Fingerprinting Against BIG-IP DNS · unlock with TL Creds

Indicators of compromise for F5 BIG-IP DNS BIND DoS

As of 2026-09-21, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2596.

13 indicators of compromise · unlock with TL Creds. Compare plans

How F5 BIG-IP DNS BIND DoS works

No F5 patch is available as of the 2026-09-21 advisory; only configuration workarounds exist.

CVE-2026-11622 is a resource-exhaustion flaw (CWE-770, Allocation of Resources Without Limits or Throttling) in the DNSSEC validation path of ISC BIND 9, publicly disclosed by ISC on 2026-07-22 as one of nine BIND CVEs patched together in BIND 9.20.26 and 9.21.24. According to ISC's advisory and the associated BIND engineering issue, a DNSSEC-validating resolver that is subjected to a random-subdomain ("water torture"-style) attack against a DNSSEC-signed zone can be forced into runaway memory growth: if an attacker sends validation queries faster than the resolver can cryptographically validate them, offloaded processing of DNSSEC answers side-steps the resolver's recursive-clients concurrency limit, so pending validation state accumulates without being bounded by the configured max-cache-size. The resolver logs numerous "hung fetch" entries and legitimate cache-hit response times degrade, though the process does not crash outright — the impact is availability-only (CVSS:3.1 C:N/I:N/A:H), scored 7.5/10.0 (High) by ISC, NVD, and Red Hat alike.

F5 confirmed in Security Advisory K000163335 that BIG-IP DNS's optional "Use BIND Server on BIG-IP" DNS-profile setting embeds the vulnerable BIND resolver, exposing BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 to the same flaw when configured as a DNSSEC-validating resolver. As of the 2026-09-21 HKCERT bulletin that surfaced this advisory, F5 has not shipped a fix and instead recommends three interim configuration workarounds: disabling DNSSEC validation in the resolver's DNS cache, switching the DNS profile's cache type to Resolver or Transparent (non-validating) mode, or disabling the "Use BIND Server on BIG-IP" option outright. ISC's own fix ships upstream in BIND 9.20.26 and 9.21.24; there is no evidence F5 has backported it into a BIG-IP hotfix yet.

No public PoC or exploit code was located, and ISC states the flaw was found during internal testing with no confirmed active exploitation or CISA KEV listing as of this writing. The flaw is nonetheless significant for defenders because BIG-IP DNS instances configured as public-facing validating resolvers or GTM/DNS load-balancing tiers are, by design, reachable by arbitrary remote clients — exactly the precondition CVE-2026-11622 requires.

MITRE ATT&CK techniques by tactic:

Remediation for F5 BIG-IP DNS BIND DoS

Patches

No F5 patch available as of 2026-09-21 (K000163335)
Upstream ISC BIND 9.20.26 and 9.21.24 (and 9.20.26-S1 for Supported Preview Edition) fix the underlying flaw, released 2026-07-22

Immediate actions

Disable DNSSEC validation in the resolver's DNS cache on any BIG-IP DNS profile acting as a validating resolver
Switch affected DNS profiles from a BIND-backed validating Resolver cache type to Transparent or a non-validating Resolver cache type
Disable the "Use BIND Server on BIG-IP" option on the DNS profile so BIG-IP DNS no longer invokes the vulnerable embedded BIND resolver

Workarounds

Disable DNSSEC in the validating resolver's DNS cache
Switch to Resolver or Transparent cache type
Disable the "Use BIND Server on BIG-IP" option on the DNS profile

Longer-term hardening

Apply F5's official BIG-IP DNS patch for CVE-2026-11622 once released under K000163335 (not yet available as of 2026-09-21)
Track and upgrade any standalone/embedded BIND 9 resolvers referenced by BIG-IP DNS to 9.20.26 or 9.21.24 per ISC guidance once F5 rebases
Monitor BIG-IP DNS resolver memory utilization, cache size, and recursive-clients / hung-fetch counters for anomalous growth consistent with a random-subdomain attack

Affected and fixed versions

F5, Inc. — BIG-IP DNS
Vulnerable versions: 17.1.0-17.1.3; 17.5.0-17.5.1; 21.1.0
Internet Systems Consortium (ISC) — BIND 9
Vulnerable versions: 9.11.0-9.18.50; 9.20.0-9.20.24; 9.21.0-9.21.23; 9.11.3-S1-9.18.50-S1 (Supported Preview Edition); 9.20.9-S1-9.20.24-S1 (Supported Preview Edition)
Fixed in: 9.20.26; 9.21.24; 9.20.26-S1

Timeline of F5 BIG-IP DNS BIND DoS

2026-07-15 ISC issues early/embargoed vendor notification of CVE-2026-11622 ahead of coordinated public disclosure.
2026-07-20 ISC issues a revised notice to vendors ahead of the public disclosure date.
2026-07-22 ISC publishes kb.isc.org/docs/cve-2026-11622 detailing the runaway memory usage mechanism and CVSS 7.5 (High) rating.
2026-07-22 ISC publicly discloses CVE-2026-11622 alongside eight other BIND 9 CVEs and releases fixed BIND 9.20.26 and 9.21.24.
2026-09-21 Threadlinqs Intelligence opens TL-2026-2596 to track the unpatched F5 BIG-IP DNS exposure.
2026-09-21 locked-ioc-12 publishes a High Risk security bulletin flagging F5's advisory for its constituents.
2026-09-21 F5 publishes Security Advisory K000163335 confirming BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the vulnerable BIND resolver via the "Use BIND Server on BIG-IP" option, with no patch yet available and only configuration workarounds offered.

Sources cited for F5 BIG-IP DNS BIND DoS

F5 BIG-IP Denial of Service Vulnerability - HKCERT Security Bulletin hkcert.org · Advisory · 2026-09-21
NVD - CVE-2026-11622 Detail NVD (NIST) · Advisory · 2026-07-22
CVE Record - CVE-2026-11622 CVE Program · Advisory
F5 Security Advisory K000163335: BIND vulnerability CVE-2026-11622 my.f5.com · Vendor report
ISC Knowledgebase: CVE-2026-11622 - Potential memory usage beyond configured limits kb.isc.org · Vendor report · 2026-07-22
[CVE-2026-11622] Runaway memory usage when under random subdomain attack into a DNSSEC-signed domain (Issue #4760) gitlab.isc.org · Research
Red Hat Customer Portal - CVE-2026-11622 access.redhat.com · Vendor report
ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw securityonline.info · News · 2026-07-22

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 8 sources; published 2026-09-21; last updated —.

F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)

Key facts for F5 BIG-IP DNS BIND DoS

Detection coverage for F5 BIG-IP DNS BIND DoS

Free detection: Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone (CVE-2026-11622)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for F5 BIG-IP DNS BIND DoS

How F5 BIG-IP DNS BIND DoS works

Initial Access

Impact

Resource Development

Reconnaissance

Remediation for F5 BIG-IP DNS BIND DoS

Patches

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of F5 BIG-IP DNS BIND DoS

Sources cited for F5 BIG-IP DNS BIND DoS

Previous and next in vulnerability

Latest Threats

🔄 Threat Comparison

F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)

Key facts for F5 BIG-IP DNS BIND DoS

Detection coverage for F5 BIG-IP DNS BIND DoS

Free detection: Water-Torture Random-Subdomain Flood Against DNSSEC-Signed Zone (CVE-2026-11622)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for F5 BIG-IP DNS BIND DoS

How F5 BIG-IP DNS BIND DoS works

Initial Access

Impact

Resource Development

Reconnaissance

Remediation for F5 BIG-IP DNS BIND DoS

Patches

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of F5 BIG-IP DNS BIND DoS

Sources cited for F5 BIG-IP DNS BIND DoS

More in vulnerability

Previous and next in vulnerability

Latest Threats

🔄 Threat Comparison