Memory-Leak Denial of Service in ISC BIND Resolvers via Crafted SVCB/HTTPS Records
AI analysis
A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.
What to do: Upgrade resolvers to the patched BIND release on your branch per ISC's CVE-2026-81563 advisory — i.e., any release newer than 9.18.50, 9.20.27, 9.21.25, 9.18.50-S1, or 9.20.27-S1 as applicable. Until patched, restrict recursion to trusted clients (allow-recursion ACLs) so internet hosts cannot drive lookups, and monitor resolver memory, restarting services that show abnormal growth. Treat unexplained loss of recursive resolution ability as a possible sign of exploitation.
Affected
| Internet Systems Consortium (ISC) BIND 9 (recursive resolver) | 9.18.0 through 9.18.50 |
| Internet Systems Consortium (ISC) BIND 9 (recursive resolver) | 9.20.0 through 9.20.27 |
| Internet Systems Consortium (ISC) BIND 9 (development branch, recursive resolver) | 9.21.0 through 9.21.25 |
| Internet Systems Consortium (ISC) BIND 9 Stable Preview Edition (recursive resolver) | 9.18.11-S1 through 9.18.50-S1 |
| Internet Systems Consortium (ISC) BIND 9 Stable Preview Edition (recursive resolver) | 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
mass≈several hundred thousand internet-exposed BIND resolvers (public open-resolver scans report hundreds of thousands of exposed recursive DNS servers), plus an… — BIND is the most widely deployed DNS server software, and recurring internet-wide scans of open recursive resolvers consistently report on the order of hundreds of thousands of exposed servers, a substantial share running BIND, with…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.