Memory-Leak Denial of Service in ISC BIND Resolvers via Crafted SVCB/HTTPS Records
A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.
· Internet Systems Consortium (ISC) BIND 9 (recursive resolver) 9.18.0 through 9.18.50 · Internet Systems Consortium (ISC) BIND 9 (recursive resolver) 9.20.0 through 9.20.27mass
Algorithmic CPU-exhaustion DoS in ISC BIND 9 resolver via cached SVCB/HTTPS records
ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.
· ISC BIND 9 (open-source branches) 9.18.0 through 9.18.50 · ISC BIND 9 (open-source branches) 9.20.0 through 9.20.27mass
DNSSEC Wildcard Non-Existence Bypass in ISC BIND 9 (named)
This is a DNSSEC validation flaw (CWE-345) in BIND 9's `named` resolver, which may accept an inapplicable NSEC record as valid proof that no wildcard record exists for a zone name. An attacker positioned at the same or an upstream level of the victim's zone name — for example, an operator of a sibling or parent zone able to present the malformed NSEC proof — can trigger the flaw in a validating resolver. The result is that the victim's wildcard record is treated as nonexistent, so the attacker can spoof or suppress answers in a way that still passes DNSSEC validation, yielding a high integrity impact (no confidentiality or availability impact per the CVSS vector). Only operators running affected BIND 9 versions as validating resolvers, particularly zones that rely on wildcard records, are affected. The issue was disclosed by ISC as one of fourteen BIND 9 vulnerabilities; it is not in CISA's KEV catalog and no public proof-of-concept or known exploitation exists.
· Internet Systems Consortium (ISC) BIND 9 (open source) 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25 · Internet Systems Consortium (ISC) BIND 9 supported preview editions (-S builds) 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1mass
DNSSEC Insecurity-Proof Bypass in ISC BIND 9 Allows Forged Unsigned Answers
BIND 9's DNSSEC validator can mistakenly accept a validly signed NSEC3 record from an unrelated sibling zone as proof that a delegation is insecure. An attacker who can inject a crafted response into a resolver's validation process (e.g., an on-path attacker or in a cache-poisoning race) can downgrade a securely signed delegation to insecure, causing a forged, unsigned answer to be accepted and cached. The impact is DNS spoofing of validating resolvers: integrity loss only, with no confidentiality or availability effect (CVSS 5.9, CWE-346 origin validation error). Any operator running an affected BIND 9 release with DNSSEC validation enabled is affected. No public proof of concept and no known in-the-wild exploitation have been reported.
· ISC BIND 9 (open-source editions) 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 · ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.27-S1mass
Zone-cut mishandling in ISC BIND 9 enables cache poisoning via malformed zones
ISC BIND 9's named daemon incorrectly treats an NS or DNAME node placed above a zone's origin as a zone cut, so an attacker who can insert a malformed zone into an authoritative server (for example, via zone transfer or by loading zones on a shared DNS service) can make queries within that configured zone lose authoritative status and return an out-of-zone delegation. On servers that also provide recursion, BIND then follows this locally sourced, attacker-influenced cut and caches attacker-supplied data, poisoning answers for names outside the configured zone; the condition persists for as long as the malformed zone remains in the zone database. Any deployment running an affected BIND 9 version that combines authoritative service for attacker-influenceable zones with recursion, or that accepts zone transfers from less-trusted sources, is exposed. ISC assigned it CVSS 5.8 (medium) with high attack complexity and high privileges required, reflecting these preconditions. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.
· ISC BIND 9 (named) 9.11.0 through 9.18.50 · ISC BIND 9 (named) 9.20.0 through 9.20.27mass
Remote DoS in ISC BIND 9 resolvers via crafted DNSSEC wildcard NSEC3/NSEC response
CVE-2026-80274 is a remotely triggerable denial-of-service (unexpected program exit, CWE-617) in ISC BIND 9 recursive resolvers when processing certain DNSSEC responses. It is triggered without authentication or user interaction when a resolver queries a DNSSEC-signed authoritative zone and receives a valid wildcard answer with a signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. A successful trigger crashes the named daemon, denying DNS service to all clients that depend on that resolver until it is restarted. Any operator running an affected BIND 9 resolver that performs DNSSEC validation is exposed (authoritative-only servers are not the crash target). No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; the flaw was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.
· ISC BIND 9 (open source, recursive resolver) 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25 · ISC BIND 9 Supported Preview Edition (-S) 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1mass
Unauthenticated DoS in ISC BIND 9 via crafted SIG(0) DNS-over-HTTPS requests
ISC BIND 9 contains a NULL pointer dereference (CWE-476) that causes the `named` daemon to abort when it receives a DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record followed by a premature close of the transport connection. An unauthenticated remote attacker can trigger the crash repeatedly, achieving a denial of service with no confidentiality or integrity impact (CVSS availability-only). Only deployments running affected 9.20.x, 9.21.x, or 9.20.x-S1 versions with DoH listeners configured are exposed; servers without DoH endpoints enabled are not vulnerable. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.
· Internet Systems Consortium (ISC) BIND 9 9.20.0 through 9.20.27 · Internet Systems Consortium (ISC) BIND 9 9.21.0 through 9.21.25large
TSIG Bypass in BIND 9 IXFR Transfers Lets Unsigned Data Poison Secondary Zones
In ISC BIND 9, a secondary server that restricts zone transfers with TSIG may begin serving data from an incoming multi-message TCP IXFR before the final message carrying the TSIG signature arrives, and it never rolls back to the pre-transfer state if that signature never arrives (CWE-349, acceptance of extraneous untrusted data). An attacker who does not possess a valid TSIG key but can impersonate the zone's primary on the transfer path (e.g., via a spoofed or man-in-the-middle transfer session) can send unauthorized zone contents, which the secondary then serves to clients. The impact is loss of DNS data integrity with limited availability impact and no confidentiality impact (CVSS 6.5, network vector with high attack complexity). Any BIND 9 deployment in the affected version ranges configured as a secondary zone with TSIG-restricted transfers is affected, and the transfer must be a multi-message TCP IXFR as described by RFC 8945. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; ISC disclosed this flaw as one of fourteen BIND 9 vulnerabilities.
· ISC BIND 9 9.11.0 through 9.18.50 · ISC BIND 9 9.20.0 through 9.20.27mass
The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute of the 'sb_ravelry_designs' shortcode in
The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute of the 'sb_ravelry_designs' shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
· WordPress—
Algorithmic complexity DoS in ISC BIND recursive resolvers via invalid DNSSEC records
ISC's BIND 9 DNS server contains a resource-exhaustion flaw (CWE-407) in which a recursive resolver consumes excessive CPU and memory when it encounters large numbers of a particular kind of invalid DNSSEC record. A remote, unauthenticated attacker can trigger this by causing a BIND resolver to process attacker-influenced DNSSEC data — for example, by having the resolver look up names served from authoritative servers that return the malformed records — degrading or halting DNS resolution (availability impact only, per the CVSS vector). Any organization operating a BIND recursive resolver in the affected version ranges is exposed, including internet-facing open resolvers and internal enterprise, campus, and ISP resolvers; ISC notes that default settings of the 'max-records-per-type' and 'max-types-per-name' limits help mitigate the exposure. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; it was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.
· ISC BIND 9 (recursive resolver) 9.11.0 through 9.18.50 · ISC BIND 9 (recursive resolver) 9.20.0 through 9.20.27mass