BIND 9 EUVD-2026-107252

No special conditions beyond network reachability - remote unauthenticated exploitation against a BIND 9 resolver that accepts and recursively processes DNS messages, which is the default behavior of a recursive resolver. The limiting factor is exposure: the resolver must be reachable by the attacker (internet-facing resolvers, or internal resolvers reachable from an attacker-controlled host or spoofed source). Authoritative-only configurations and resolvers restricted to trusted clients via ACLs substantially reduce the realistic attack surface. Affected versions are 9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26, and the subscription builds 9.11.3-S1-9.18.50-S1 and 9.20.9-S1-9.20.29-S1; patched builds are 9.20.30 and 9.21.27.

This is a genuine but bounded operational risk. The CVSS 7.5 is driven entirely by availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - remote, unauthenticated, low-complexity, no user interaction, consistent with the CWE-407 (algorithmic complexity) resource-exhaustion class. There is no confidentiality or integrity exposure despite the 'Information Disclosure' tag, which contradicts the vector (C:N/I:N) and appears mislabeled. No CISA KEV listing and no EPSS score were supplied, so there is no evidence of active exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' However, DoS flaws in a resolver reachable from the network are historically attractive and often trivially reproducible once the triggering message structure is understood, so defenders should not treat the absence of a POC as low likelihood. Net assessment: a real patch-priority issue for internet-facing or shared recursive resolvers because of ubiquity and unauthenticated network reach, but lower urgency than a code-execution or data-exposure bug since impact is confined to availability and a vendor patch already exists.

A remote, unauthenticated attacker sends a specially crafted DNS message containing a maliciously large number of the triggering structures to a BIND 9 recursive resolver. BIND performs unbounded additional processing per structure, consuming disproportionate CPU and memory and degrading or denying service to legitimate clients. No public exploit code has been identified at the time of analysis, but the low attack complexity makes reproduction straightforward.