Executive brief
ISC BIND is a widely-used DNS resolver software that processes domain name queries. A vulnerability in how BIND handles malformed DNSSEC records can cause it to consume excessive CPU and memory resources when encountering certain invalid records, potentially degrading DNS service availability. Organizations running BIND recursive resolvers may experience service disruptions if targeted with specially crafted DNS traffic.
Technical details
The vulnerability is a denial-of-service condition in BIND's recursive resolver when processing certain types of invalid DNSSEC records. The root cause involves resource consumption that scales with the number of malformed records encountered. Attack requires network connectivity to the resolver (typically UDP/TCP port 53) and involves crafting and sending specially-formed DNS queries containing invalid DNSSEC data. An attacker can exhaust resolver resources (CPU, memory) and degrade or disable DNS resolution services. Patches are available in BIND 9.18.51, 9.20.28, 9.21.26 and later versions; the built-in "max-records-per-type" and "max-types-per-name" configuration limits help mitigate exposure for unpatched systems.
Affected products
- ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released: BIND 9.18.51, 9.20.28, 9.21.26