Executive brief
BIND is a widely-used DNS resolver software that handles domain name lookups for organizations and ISPs. A flaw in how BIND processes DNSSEC-signed responses can cause the resolver process to crash when an attacker controls an authoritative nameserver and sends carefully timed, malformed responses. This creates a denial-of-service condition, disrupting DNS resolution for all users depending on that resolver.
Technical details
The vulnerability is a use-after-free bug in BIND's qpcache (query/proof cache) module when processing NOQNAME proofs for DNSSEC-signed zones. An attacker must control an authoritative nameserver and induce a victim resolver to send multiple queries for a DNSSEC-signed zone. By responding with a crafted sequence of answers that arrive in a specific order and timing, the resolver's cache logic dereferences memory that has already been freed, triggering a crash. The attack is remotely exploitable but requires high complexity conditions (AC:H) including precise timing and the attacker's control of an authoritative server. Patches are available in BIND 9.20.29 and 9.20.29-S1.
Affected products
- ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed: Public disclosure
- 2026-09-16: patched: Fixed in BIND 9.20.29 and 9.20.29-S1