CVE-2026-81563: BIND DNS Resolver DoS Vulnerability

CVE-2026-81563 Overview

CVE-2026-81563 is a memory leak vulnerability [CWE-401] in ISC BIND 9 recursive resolvers. When the resolver processes an SVCB or HTTPS AliasMode record that references 14 or more SVCB/HTTPS ServiceMode records, it fails to deallocate internal resources correctly. Repeated queries triggering this condition exhaust resolver memory over time. Once exhausted, the resolver cannot service new recursive lookups, producing a denial-of-service condition against DNS infrastructure. The flaw is network-reachable, requires no authentication, and no user interaction. Affected versions include BIND 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the Supported Preview (S1) editions 9.18.11-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1.

Critical Impact
Remote unauthenticated attackers can exhaust resolver memory by repeatedly triggering DNS lookups that resolve to malicious SVCB/HTTPS AliasMode records, blocking new recursive queries.

Affected Products

ISC BIND 9.18.0 through 9.18.50 (including 9.18.11-S1 through 9.18.50-S1)
ISC BIND 9.20.0 through 9.20.27 (including 9.20.9-S1 through 9.20.27-S1)
ISC BIND 9.21.0 through 9.21.25

Discovery Timeline

2026-09-16 - CVE-2026-81563 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81563

Vulnerability Analysis

BIND 9 supports the Service Binding (SVCB) and HTTPS resource record types defined in RFC 9460. SVCB records operate in two modes: AliasMode, which redirects clients to another target name, and ServiceMode, which conveys parameters used to connect to a service endpoint. The resolver traverses AliasMode chains and processes the ServiceMode records they reference.

When an AliasMode target set contains 14 or more ServiceMode records, the resolver's cleanup path fails to release allocated structures associated with the additional records. Each recursive lookup that satisfies this condition strands memory that the resolver never reclaims. An attacker who controls an authoritative zone can craft records that reliably trigger the leak, then drive victim resolvers to that zone through spam, phishing, or embedded content. Sustained query volume drives the resolver toward memory exhaustion, at which point it stops accepting new recursive work.

Root Cause

The defect is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). BIND's handling of AliasMode responses does not free every allocation associated with referenced ServiceMode records when the referenced set exceeds a threshold of 14 entries. The leak accumulates across repeated resolutions.

Attack Vector

Exploitation requires only that a target resolver perform recursive lookups for names within an attacker-controlled zone. The attacker publishes an SVCB or HTTPS AliasMode record referencing 14 or more ServiceMode records. Any mechanism that induces the resolver to query those names, including HTML content, email tracking pixels, or automated scanners, will trigger the leak. No credentials or user interaction on the resolver itself are required. See the ISC CVE-2026-81563 Documentation for the vendor's technical description.

Detection Methods for CVE-2026-81563

Indicators of Compromise

Steadily rising resident memory usage on named processes with no corresponding growth in cache size or client load.
Increased frequency of SERVFAIL responses and recursive query timeouts as resolver memory nears exhaustion.
Elevated volume of outbound queries for SVCB (type 64) and HTTPS (type 65) records to unfamiliar authoritative name servers.
BIND log entries indicating allocator failures or refusal to accept new recursive clients.

Detection Strategies

Baseline named memory consumption and alert on sustained growth that decouples from cache metrics reported via the BIND statistics channel.
Inspect DNS telemetry for repeated resolutions of the same AliasMode target chain returning large ServiceMode record sets.
Correlate resolver health degradation with recent queries for SVCB and HTTPS record types across the environment.

Monitoring Recommendations

Enable and scrape the BIND statistics channel to track resolver-queries, memory contexts, and SERVFAIL counters.
Forward named logs to a centralized analytics platform and alert on allocator warnings or recursion-client saturation.
Monitor SVCB/HTTPS query patterns at network egress points and flag zones returning unusually large ServiceMode record sets.

How to Mitigate CVE-2026-81563

Immediate Actions Required

Upgrade recursive resolvers to BIND 9.20.29 or 9.21.26, or the corresponding fixed 9.18 and S1 releases published by ISC.
Inventory all BIND deployments, including hidden resolvers, forwarders, and appliances embedding BIND, and prioritize internet-exposed instances.
Restart named on affected hosts to reclaim leaked memory while patch deployment is in progress.

Patch Information

ISC has released fixed versions of BIND 9. Refer to the ISC BIND9 Version 9.20.29 and ISC BIND9 Version 9.21.26 downloads, and consult the ISC CVE-2026-81563 Documentation for the full list of fixed releases across the 9.18, 9.20, 9.21, and S1 branches. Apply the update matching your current branch to avoid regression.

Workarounds

No specific configuration workaround is published by ISC. Upgrading is the required remediation.
Restrict recursion to trusted client networks using allow-recursion to reduce the attacker population able to trigger lookups.
Schedule periodic restarts of named on unpatched systems to reset leaked memory and preserve availability until patches are applied.

bash

# Restrict recursion and verify BIND version after upgrade
named -v

# Example named.conf snippet limiting recursion to internal clients
options {
    recursion yes;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
    allow-query-cache { 10.0.0.0/8; 192.168.0.0/16; };
};