ISC BIND 9 CVE-2026-81736

Exploitable against a BIND 9 recursive resolver (versions 9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, and -S1 preview builds 9.18.11-S1-9.18.50-S1 / 9.20.9-S1-9.20.27-S1) that has cached a tree of SVCB/HTTPS AliasMode records; the trigger is a query for the root of that cached tree. The specific limiting factor is that the AliasMode record tree must first be resident in the resolver cache, so the attacker must be able to cause those records to be resolved and cached (e.g., via an attacker-controlled zone) before issuing the triggering query. No authentication or user interaction is required (PR:N/UI:N); the resolver must simply be reachable and performing recursion.

This is a genuine availability-only denial-of-service in ISC BIND 9's resolver, and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: remote, unauthenticated, low-complexity, no user interaction, with impact confined to availability (C:N/I:N/A:H). CWE-1050 (excessive resource consumption within a loop) matches the described disproportionate CPU cost of constructing the response. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is unproven in the wild - this is a defensive/patch-priority item rather than a confirmed active threat. The one signal that raises priority above a typical niche DoS is prevalence: BIND 9 is the reference DNS resolver deployed across a very large share of DNS infrastructure, so a reliably triggerable CPU-exhaustion bug in a recursive resolver warrants prompt patching. One data conflict must be flagged: the input Tags include 'Information Disclosure,' which directly contradicts the CVSS vector (C:N, A:H) - this is a denial-of-service, not a confidentiality issue, and the tag is mislabeled.

An attacker controls (or lures the resolver into caching) a tree of SVCB/HTTPS AliasMode records, then sends the resolver a query for the root of that tree; constructing the response consumes disproportionate CPU. Repeating this degrades or exhausts the resolver's processing capacity, denying DNS service to legitimate clients. No public exploit code was identified at time of analysis, and the attack requires only network reachability to the recursive resolver.