EUVD-2026-80740
GHSA-hjmx-qf9h-v7mw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated query to a recursive resolver (AV:N/PR:N/UI:N); the cache-priming step adds setup but not enough to raise AC; impact is availability-only CPU exhaustion (A:H, C:N/I:N).
Primary rating from Vendor (isc).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AnalysisAI
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against a BIND 9 recursive resolver (versions 9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, and -S1 preview builds 9.18.11-S1-9.18.50-S1 / 9.20.9-S1-9.20.27-S1) that has cached a tree of SVCB/HTTPS AliasMode records; the trigger is a query for the root of that cached tree. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability-only denial-of-service in ISC BIND 9's resolver, and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: remote, unauthenticated, low-complexity, no user interaction, with impact confined to availability (C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a vendor-released patched BIND 9 build; ISC's patch references for this advisory point to the updated release trees at https://downloads.isc.org/isc/bind9/9.20.29 and https://downloads.isc.org/isc/bind9/9.21.26, with corresponding fixes expected across the affected 9.18 (including -S1 preview) and 9.20/9.21 branches - consult https://kb.isc.org/docs/cve-2026-81736 to confirm the exact patched version for your branch before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all BIND 9 recursive resolvers and confirm which fall in the affected ranges (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, and the preview builds 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1), prioritize internet-facing and core resolvers used by the largest client populations, and apply the vendor-released update per the vendor advisory to move each instance above the affected version ranges; where change control delays patching, apply interim mitigations such as restricting recursive service to known client networks and enabling response-rate limiting on the exposed resolvers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 DNS servers configured with TKEY GSS-API authentication allows remote unauthenticated at
Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash th
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today