AI analysis
ISC BIND 9 fails to deduplicate records that should appear only once in a query response, such as an SOA record: when an attacker supplies multiple copies whose RDATA is identical, each copy is appended to the in-memory RDATA set. A remote attacker controlling or spoofing a response source can repeatedly trigger this to inflate the negative cache, driving up memory usage and opening the door to further memory-based attacks. The attacker gains gradual resource exhaustion on the resolver, leading to degraded or denied availability (CWE-405, low availability impact per CVSS). Any BIND 9 deployment in the listed versions is affected, with recursive/caching resolvers that cache negative answers from untrusted zones most exposed. Exploitation status: no known exploitation, no public proof-of-concept, and not listed in CISA KEV; the flaw is one of fourteen BIND 9 issues disclosed by ISC.
What to do: Upgrade named to a patched release per ISC's advisory for this disclosure batch (any version after 9.18.50/9.20.27/9.21.25 and the matching -S1 builds is vulnerable; install the fixed versions ISC lists). Until patching, restrict recursion to trusted clients on caching resolvers and monitor named memory usage for unexplained growth. Track the full set of fourteen BIND 9 CVEs disclosed by ISC and apply the associated updates together.
Affected
| ISC BIND 9 (open source editions) | 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 |
| ISC BIND 9 Stable Snapshot editions (S1) | 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
mass≈500,000+ internet-exposed BIND 9 servers, plus far more behind firewalls (BIND is the most widely deployed DNS server and the vulnerable range spans all… — Internet-wide DNS banner scans (e.g., Shodan/Censys) have long shown BIND as the dominant DNS server software with hundreds of thousands of visible instances, and the affected version ranges cover essentially every supported release since…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.