Algorithmic CPU-exhaustion DoS in ISC BIND 9 resolver via cached SVCB/HTTPS records
ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.
· ISC BIND 9 (open-source branches) 9.18.0 through 9.18.50 · ISC BIND 9 (open-source branches) 9.20.0 through 9.20.27mass
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
· isc bind—
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0…
· isc bind—
Memory-Leak Denial of Service in ISC BIND Resolvers via Crafted SVCB/HTTPS Records
A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.
· Internet Systems Consortium (ISC) BIND 9 (recursive resolver) 9.18.0 through 9.18.50 · Internet Systems Consortium (ISC) BIND 9 (recursive resolver) 9.20.0 through 9.20.27mass
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
· isc bind—
Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record.
Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.
· isc bind—
Zone-cut mishandling in ISC BIND 9 enables cache poisoning via malformed zones
ISC BIND 9's named daemon incorrectly treats an NS or DNAME node placed above a zone's origin as a zone cut, so an attacker who can insert a malformed zone into an authoritative server (for example, via zone transfer or by loading zones on a shared DNS service) can make queries within that configured zone lose authoritative status and return an out-of-zone delegation. On servers that also provide recursion, BIND then follows this locally sourced, attacker-influenced cut and caches attacker-supplied data, poisoning answers for names outside the configured zone; the condition persists for as long as the malformed zone remains in the zone database. Any deployment running an affected BIND 9 version that combines authoritative service for attacker-influenceable zones with recursion, or that accepts zone transfers from less-trusted sources, is exposed. ISC assigned it CVSS 5.8 (medium) with high attack complexity and high privileges required, reflecting these preconditions. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.
· ISC BIND 9 (named) 9.11.0 through 9.18.50 · ISC BIND 9 (named) 9.20.0 through 9.20.27mass
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cau
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
· isc bind—
Algorithmic complexity DoS in ISC BIND recursive resolvers via invalid DNSSEC records
ISC's BIND 9 DNS server contains a resource-exhaustion flaw (CWE-407) in which a recursive resolver consumes excessive CPU and memory when it encounters large numbers of a particular kind of invalid DNSSEC record. A remote, unauthenticated attacker can trigger this by causing a BIND resolver to process attacker-influenced DNSSEC data — for example, by having the resolver look up names served from authoritative servers that return the malformed records — degrading or halting DNS resolution (availability impact only, per the CVSS vector). Any organization operating a BIND recursive resolver in the affected version ranges is exposed, including internet-facing open resolvers and internal enterprise, campus, and ISP resolvers; ISC notes that default settings of the 'max-records-per-type' and 'max-types-per-name' limits help mitigate the exposure. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; it was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.
· ISC BIND 9 (recursive resolver) 9.11.0 through 9.18.50 · ISC BIND 9 (recursive resolver) 9.20.0 through 9.20.27mass
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack.
BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
· isc bind—