CVE-2026-81563
published 2026-09-16CVE-2026-81563: A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.57%
46.8th percentile
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| isc | bind | — | — |
| isc | bind_9 | 9.18.0 – 9.18.50 | — |
| isc | bind_9 | 9.18.11-S1 – 9.18.50-S1 | — |
| isc | bind_9 | 9.20.0 – 9.20.27 | — |
| isc | bind_9 | 9.20.9-S1 – 9.20.27-S1 | — |
| isc | bind_9 | 9.21.0 – 9.21.25 | — |
| ubuntu | bind9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu8.6HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 8.6
CVE-2026-19033 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack. This issue
only affected Ubuntu 18.04 LTS. (CVE-2025-40778)
Samy Medjahed discovered that Bind incorrectly handled insecure delegation
validation. A remote attacker could possibly use this iss
Red Hat
bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
vendor_redhat·2026-09-16·CVSS 7.5
CVE-2026-81563 [HIGH] CWE-772 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly r
VulDB
ISC BIND up to 9.21.24 Resolver resource consumption (Nessus ID 347971)
vuldb·2026-09-18·CVSS 7.5
CVE-2026-81563 [HIGH] ISC BIND up to 9.21.24 Resolver resource consumption (Nessus ID 347971)
A vulnerability categorized as critical has been discovered in ISC BIND up to 9.18.49/9.18.50-S1/9.20.26/9.20.27-S1/9.21.24. Impacted is an unknown function of the component Resolver. Such manipulation leads to resource consumption.
This vulnerability is listed as CVE-2026-81563. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources.
ghsa_unreviewed·2026-09-16
CVE-2026-81563 [HIGH] CWE-401 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources.
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing [fedora-all]
bugzilla·2026-09-17·CVSS 7.5
CVE-2026-81563 [HIGH] CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing [fedora-all]
CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 thr
Bugzilla
CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
bugzilla·2026-09-16·CVSS 7.5
CVE-2026-81563 [HIGH] CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
CVE-2026-81563 bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Hackernews
BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
blogs_hackernews·2026-09-17·CVSS 5.9
CVE-2026-19662 [MEDIUM] BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).
A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.
ISC said in its advisories that it is not aware of any of the fourteen being ex
2026-09-16
Published