Executive brief
ISC BIND 9 is a widely used software for managing Domain Name System (DNS) services. A vulnerability in its security validation process allows a remote attacker to send specially crafted data that causes the server to consume excessive processor resources. This can lead to a significant slowdown or complete loss of DNS service, preventing users from accessing websites and other network resources.
Technical details
A denial-of-service vulnerability exists in BIND 9 resolvers when performing DNSSEC validation. The issue is caused by unchecked input for loop conditions (CWE-606) during the validation of insecure delegations involving NSEC3 records. A remote attacker can provide a maliciously crafted zone with excessive NSEC3 iterations, forcing the resolver to spend an inordinate amount of CPU time on validation. This results in a sharp decrease in the number of queries per second (QPS) the resolver can handle. Authoritative-only servers are generally unaffected unless they are configured to perform recursive queries. Patches are available in versions 9.18.47, 9.20.21, and 9.21.20.
Affected products
- ISC BIND 9 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, 9.20.9-S1 through 9.20.20-S1
Timeline
- 2026-03-18: other: Early notification provided to partners
- 2026-03-25: advisory: Public disclosure by ISC
- 2026-03-25: patched: Patched versions 9.18.47, 9.20.21, and 9.21.20 released
- 2026-04-13: other: Debian LTS advisory published