CVE-2026-75029: BIND 9 DNS Server DoS Vulnerability

CVE-2026-75029 Overview

CVE-2026-75029 affects the Internet Systems Consortium (ISC) BIND 9 DNS server. An attacker can craft a query response containing multiple copies of a record that should exist only once, such as a Start of Authority (SOA) record. When the RDATA is identical across copies, named appends each copy to the in-memory RDATA set. The behavior inflates the negative cache and may create additional memory-based attack surface.

The issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding Subscription Edition (-S1) releases. The vulnerability is classified under [CWE-405: Asymmetric Resource Consumption (Amplification)].

Critical Impact
Remote attackers can amplify memory consumption in the BIND resolver's negative cache without authentication, degrading DNS resolver availability.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND 9 Subscription Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE CVE-2026-75029 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-75029

Vulnerability Analysis

BIND 9 caches DNS response data in memory to accelerate subsequent lookups. Certain record types, including SOA records, are singleton by protocol design and should appear only once in a response section. The resolver does not deduplicate identical RDATA when the same singleton record appears multiple times in an attacker-controlled response.

Each duplicate copy is appended to the in-memory RDATA set associated with the negative cache entry. Over many crafted responses, the resolver's memory footprint grows disproportionately to the number of legitimate cached names. The imbalance between input size and memory consumed produces an asymmetric resource-consumption condition consistent with [CWE-405].

Root Cause

The root cause is missing enforcement of singleton semantics on RDATA sets during response processing. The parser accepts duplicate identical records rather than rejecting them or collapsing them into a single entry. This permits negative-cache entries to store repeated identical data indefinitely, bounded only by resolver memory limits.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker capable of returning DNS responses to a queried resolver, either by operating an authoritative server for a queried zone or by winning a response race, can send responses with repeated SOA or other singleton records. Repeated queries under attacker control amplify memory usage in the negative cache. Refer to the ISC CVE-2026-75029 Documentation for protocol-level detail.

Detection Methods for CVE-2026-75029

Indicators of Compromise

Sustained growth of the named resident set size (RSS) without a corresponding increase in unique cached names.
DNS responses observed on the wire containing multiple identical SOA or other singleton records in a single message.
Elevated query volume from internal clients toward attacker-controlled or unusual authoritative zones.

Detection Strategies

Monitor named memory statistics through the rndc status and rndc stats interfaces for anomalous negative-cache growth.
Deploy packet inspection or DNS-aware sensors to flag responses with duplicate singleton records in the answer or authority sections.
Correlate resolver memory metrics with outbound query destinations to identify zones triggering abnormal cache expansion.

Monitoring Recommendations

Alert on named process memory exceeding baseline thresholds over rolling time windows.
Log and review DNS response parse errors and cache eviction events.
Track resolver query latency for regression that correlates with memory pressure.

How to Mitigate CVE-2026-75029

Immediate Actions Required

Upgrade BIND 9 to a patched release: 9.20.29, 9.21.26, or the equivalent Subscription Edition build.
Restrict recursion to trusted client networks using allow-recursion to reduce exposure from external requestors.
Enforce memory limits on the named process using max-cache-size and operating-system resource controls.

Patch Information

ISC has released fixed versions available from the ISC BIND 9.20.29 Download and ISC BIND 9.21.26 Download pages. Subscription Edition customers should obtain the corresponding -S1 build from ISC. Full advisory content is available in the ISC CVE-2026-75029 Documentation.

Workarounds

Configure a conservative max-cache-size value in named.conf to cap resolver memory growth.
Segment resolvers so that external-facing and internal recursive services do not share memory pools.
Restart named on a scheduled interval as a temporary control until patches are deployed.

bash

# Configuration example: cap resolver cache size and restrict recursion
options {
    max-cache-size 512m;
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
};