Executive brief
BIND is a widely-deployed DNS resolver software used by organizations to translate domain names to IP addresses. An attacker can send specially-crafted DNS responses containing duplicate records (like SOA records) to exhaust the resolver's memory through its negative cache, potentially causing performance degradation or service unavailability.
Technical details
A flaw in BIND's DNS query response handling allows an attacker to send multiple copies of records that should exist only once (e.g., SOA records) in a single response. When the RDATA (resource record data) is identical across all copies, BIND appends each record to its in-memory negative cache instead of deduplicating, leading to unbounded memory growth. This is a network-reachable vulnerability requiring no authentication; an attacker can repeatedly send malicious responses to trigger memory exhaustion. The vulnerability affects BIND 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, and their -S1 (FIPS) variants. Patches are available in BIND 9.18.51+, 9.20.28+, and 9.21.26+.
Affected products
- ISC BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed: CVE-2026-75029 published
- 2026-09-16: patched: BIND 9.18.51, 9.20.28, and 9.21.26 released with fixes