# F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)

> F5 BIG-IP DNS versions 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 embed the BIND 9 DNSSEC-validating resolver affected by CVE-2026-11622, letting a remote, unauthenticated attacker running a random-subdomain attack against a DNSSEC-signed zone drive resolver memory usage orders of magnitude past the configured max-cache-size limit. No F5 patch is available as of the 2026-09-21 advisory; only configuration workarounds exist.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2596
- **ID:** TL-2026-2596
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-11622

## Description

CVE-2026-11622 is a resource-exhaustion flaw (CWE-770, Allocation of Resources Without Limits or Throttling) in the DNSSEC validation path of ISC BIND 9, publicly disclosed by ISC on 2026-07-22 as one of nine BIND CVEs patched together in BIND 9.20.26 and 9.21.24. According to ISC's advisory and the associated BIND engineering issue, a DNSSEC-validating resolver that is subjected to a random-subdomain ("water torture"-style) attack against a DNSSEC-signed zone can be forced into runaway memory growth: if an attacker sends validation queries faster than the resolver can cryptographically validate them, offloaded processing of DNSSEC answers side-steps the resolver's recursive-clients concurrency limit, so pending validation state accumulates without being bounded by the configured max-cache-size. The resolver logs numerous "hung fetch" entries and legitimate cache-hit response times degrade, though the process does not crash outright — the impact is availability-only (CVSS:3.1 C:N/I:N/A:H), scored 7.5/10.0 (High) by ISC, NVD, and Red Hat alike.

F5 confirmed in Security Advisory K000163335 that BIG-IP DNS's optional "Use BIND Server on BIG-IP" DNS-profile setting embeds the vulnerable BIND resolver, exposing BIG-IP DNS 17.1.0-17.1.3, 17.5.0-17.5.1, and 21.1.0 to the same flaw when configured as a DNSSEC-validating resolver. As of the 2026-09-21 HKCERT bulletin that surfaced this advisory, F5 has not shipped a fix and instead recommends three interim configuration workarounds: disabling DNSSEC validation in the resolver's DNS cache, switching the DNS profile's cache type to Resolver or Transparent (non-validating) mode, or disabling the "Use BIND Server on BIG-IP" option outright. ISC's own fix ships upstream in BIND 9.20.26 and 9.21.24; there is no evidence F5 has backported it into a BIG-IP hotfix yet.

No public PoC or exploit code was located, and ISC states the flaw was found during internal testing with no confirmed active exploitation or CISA KEV listing as of this writing. The flaw is nonetheless significant for defenders because BIG-IP DNS instances configured as public-facing validating resolvers or GTM/DNS load-balancing tiers are, by design, reachable by arbitrary remote clients — exactly the precondition CVE-2026-11622 requires.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1590.002 DNS
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1588.002 Tool
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation

## Sources

- [F5 BIG-IP Denial of Service Vulnerability - HKCERT Security Bulletin](https://www.hkcert.org/security-bulletin/f5-big-ip-denial-of-service-vulnerability_20260921)
- [F5 Security Advisory K000163335: BIND vulnerability CVE-2026-11622](https://my.f5.com/manage/s/article/K000163335)
- [ISC Knowledgebase: CVE-2026-11622 - Potential memory usage beyond configured limits](https://kb.isc.org/docs/cve-2026-11622)
- [NVD - CVE-2026-11622 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-11622)
- [CVE-2026-11622 Runaway memory usage when under random subdomain attack into a DNSSEC-signed domain (Issue #4760)](https://gitlab.isc.org/isc-projects/bind9/-/work_items/4760)
- [ISC Patches 9 BIND 9 Vulnerabilities, Including a DNSSEC Cache Poisoning Flaw](https://securityonline.info/bind-vulnerability-9-cves-dnssec/)
- [Red Hat Customer Portal - CVE-2026-11622](https://access.redhat.com/security/cve/cve-2026-11622)
- [CVE Record - CVE-2026-11622](https://www.cve.org/CVERecord?id=CVE-2026-11622)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2596