Description

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-22T15:16:51.703Z",
  "pubdate": "2026-07-22T15:16:51.703Z",
  "executiveSummary": "This vulnerability involves runaway memory usage in DNSSEC validating resolvers during a random subdomain attack against a DNSSEC-signed zone.\nThe primary impact is severe resource exhaustion, where memory consumption grows by orders of magnitude beyond the configured max-cache-size parameter, potentially leading to denial of service conditions.\nThe affected products include BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.\nThe risk implications include potential operational failure of the DNS infrastructure due to unmitigated memory allocation.\nAttacker capabilities require the ability to send DNS queries faster than the target resolver can perform cryptographic validation.\nExploitation requirements include targeting a DNSSEC-signed zone with a random subdomain attack pattern against a DNSSEC validating resolver.",
  "technicalDetails": "The vulnerability resides within the DNSSEC validation and caching components of BIND 9, specifically affecting how the resolver manages memory allocations when processing uncacheable or non-existent random subdomain queries for DNSSEC-signed zones.\nThe root cause is the failure of internal memory bounding mechanisms to correctly enforce the configured limits set by the max-cache-size parameter during high-volume validation processing.\nExploitation occurs via a network-based attack vector where an unauthenticated attacker floods the DNSSEC validating resolver with queries for randomized subdomains within a target DNSSEC-signed zone.\nThe attack flow begins when the attacker generates a high volume of unique, non-existent subdomain queries faster than the resolver can execute cryptographic validations.\nAs the resolver attempts to process and validate these incoming requests, internal data structures accumulate unvalidated or pending validation states in memory.\nBecause the memory management logic fails to restrict this specific overhead, memory usage bypasses the max-cache-size threshold entirely, scaling by orders of magnitude.\nNo authentication or elevated privileges are required to initiate the network queries, exposing any publicly accessible or internal validating resolver handling external zones to potential resource exhaustion.\nThe post-exploitation impact is limited to denial of service through resource exhaustion, crashing the process or degrading host operating system stability via out-of-memory termination."
}