Executive brief
ISC BIND is a widely-deployed DNS resolver used by organizations worldwide to translate domain names into IP addresses. A flaw in how BIND handles certain DNS record types (SVCB/HTTPS AliasMode) can cause it to leak internal memory when processing maliciously crafted DNS responses. Repeated exploitation exhausts resolver resources, eventually causing the DNS service to stop responding to legitimate queries and disrupting network connectivity for dependent systems.
Technical details
The vulnerability is a resource leak in BIND's handling of SVCB/HTTPS AliasMode DNS records that reference 14 or more SVCB/HTTPS ServiceMode records. The resolver fails to properly deallocate internal data structures during processing of such records. An attacker can trigger this leak by crafting DNS responses containing malformed SVCB/HTTPS records; no authentication is required and the attack is triggered by network-reachable DNS queries. With repeated exploitation, memory exhaustion causes the resolver to deny service on new recursive lookups. Patches are available in BIND 9.18.51, 9.20.28, 9.21.26, and corresponding -S1 (security-only) maintenance releases.
Affected products
- ISC BIND 9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, 9.18.11-S1-9.18.50-S1, 9.20.9-S1-9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches released: BIND 9.18.51, 9.20.28, 9.21.26 and corresponding -S1 releases