Description
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
References (4)
Core 4
Core References
Patch patch
https://downloads.isc.org/isc/bind9/9.18.49
Patch patch
https://downloads.isc.org/isc/bind9/9.20.23
Patch patch
https://downloads.isc.org/isc/bind9/9.21.22
Scores
CVSS v3
5.3
EPSS
0.0007
EPSS Percentile
21.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-606
Status
published
Products (6)
isc/bind
9.18.36 - 9.18.49
ISC/BIND 9
9.18.36 - 9.18.48
ISC/BIND 9
9.18.36-S1 - 9.18.48-S1
ISC/BIND 9
9.20.8 - 9.20.22
ISC/BIND 9
9.20.9-S1 - 9.20.22-S1
ISC/BIND 9
9.21.7 - 9.21.21
Published
May 20, 2026
Tracked Since
May 20, 2026