Algorithmic CPU-exhaustion DoS in ISC BIND 9 resolver via cached SVCB/HTTPS records
AI analysis
ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.
What to do: Upgrade each deployed branch to the patched release outside the listed ranges (i.e., later than 9.18.50 / 9.20.27 / 9.21.25 or the corresponding -S1 builds) as published in ISC's advisory. Until patched, verify your version with 'named -v', ensure the resolver is not open to the internet by restricting recursion to trusted clients, monitor named CPU utilization for anomalies, and flush the cache if a suspicious SVCB/HTTPS AliasMode tree is suspected.
Affected
| ISC BIND 9 (open-source branches) | 9.18.0 through 9.18.50 |
| ISC BIND 9 (open-source branches) | 9.20.0 through 9.20.27 |
| ISC BIND 9 (development branch) | 9.21.0 through 9.21.25 |
| ISC BIND 9 (Supported Preview subscription) | 9.18.11-S1 through 9.18.50-S1 |
| ISC BIND 9 (Supported Preview subscription) | 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
masslikely millions of installations served via ~100,000+ internet-exposed BIND resolvers; exact count unknown — BIND is the most widely deployed DNS server software and runs the recursive resolvers of many ISPs, enterprises and hosting providers; internet-wide scans have long identified BIND on the order of hundreds of thousands of exposed DNS…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.