Executive brief
ISC BIND is a widely-deployed DNS resolver software used by internet service providers and enterprises to resolve domain names. A vulnerability in its handling of cached SVCB/HTTPS AliasMode records can cause the resolver to consume disproportionate CPU resources when responding to queries, potentially causing denial of service and degrading the performance of DNS resolution services that depend on it.
Technical details
The vulnerability is a denial-of-service condition in BIND's DNS resolver implementation. When a resolver has cached a tree of SVCB/HTTPS AliasMode records and receives a query for the root of that tree, it spends excessive CPU time constructing the response, resulting in high computational overhead. The attack requires that the resolver has already cached the vulnerable record structure, and an attacker can trigger the condition by sending a DNS query targeting the root of a cached SVCB/HTTPS AliasMode tree. The issue affects multiple active versions of BIND 9, and patches are available in BIND 9.20.29, 9.21.26, and corresponding security releases.
Affected products
- ISC BIND 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: BIND 9.20.29, 9.21.26, and corresponding security releases