CVE-2026-81736: BIND Resolver DoS Vulnerability

CVE-2026-81736 Overview

CVE-2026-81736 is a denial-of-service vulnerability in ISC BIND 9 resolvers. When a BIND resolver has cached a tree of Service Binding (SVCB) or HTTPS AliasMode records and receives a query for the root of that tree, it consumes disproportionate CPU time constructing the response. A remote attacker can trigger repeated expensive resolutions to exhaust resolver CPU resources and degrade DNS service availability.

The flaw affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding Supported Preview (-S1) branches. The weakness is classified under [CWE-1050] (Excessive Platform Resource Consumption within a Loop).

Critical Impact
Remote, unauthenticated attackers can degrade or disrupt recursive DNS service by forcing resolvers to burn CPU on cached SVCB/HTTPS AliasMode trees.

Affected Products

ISC BIND 9 versions 9.18.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview 9.18.11-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-81736 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81736

Vulnerability Analysis

BIND 9 resolvers support DNS Service Binding records defined in RFC 9460, including SVCB and HTTPS record types. These records may be published in AliasMode, which redirects clients to another target name and can be chained across multiple owner names to form a resolution tree.

When a resolver has already cached such a chain and later receives a query for the root of that tree, the response construction path performs redundant work across the cached tree. The processing effort grows disproportionately with the tree size, tying up a resolver worker on a single query.

An attacker with the ability to send recursive queries can prime a cache with a deep or wide AliasMode tree, then repeatedly query the root to force sustained CPU consumption. Confidentiality and integrity are not affected; the impact is limited to availability of the DNS service.

Root Cause

The root cause is inefficient response assembly logic over cached SVCB/HTTPS AliasMode chains. The resolver revisits or reprocesses tree elements when constructing the answer for the root, resulting in excessive CPU work per query. The behavior aligns with [CWE-1050], where a loop performs more platform work than necessary.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends recursive DNS queries that first cause the resolver to cache an AliasMode tree, then repeatedly issues queries for the root name of that tree. No specialized tooling is required beyond the ability to send DNS queries and control authoritative records for a domain used to prime the cache.

The vulnerability is described in the ISC CVE-2026-81736 Documentation. No public proof-of-concept exploit code has been published at the time of writing.

Detection Methods for CVE-2026-81736

Indicators of Compromise

Sustained high CPU utilization on BIND named worker threads without a corresponding increase in overall query rate.
Growing query latency and client timeouts for recursive lookups during otherwise normal traffic volumes.
Repeated recursive queries from the same client set for the root of an SVCB or HTTPS AliasMode tree.

Detection Strategies

Inspect BIND query logs for repeated SVCB and HTTPS queries targeting the same owner name that resolves through an AliasMode chain.
Correlate named process CPU spikes with query-type distribution to identify anomalous SVCB/HTTPS query concentration.
Alert when a small number of source IPs generate a large share of SVCB/HTTPS queries against the same zone.

Monitoring Recommendations

Enable BIND query logging and export statistics from the rndc stats channel to a central telemetry pipeline.
Monitor per-view and per-server CPU, response latency, and SERVFAIL rates for recursive resolvers.
Track cache contents growth for SVCB and HTTPS record types to detect intentional priming of AliasMode trees.

How to Mitigate CVE-2026-81736

Immediate Actions Required

Upgrade BIND 9 to a fixed release on every recursive resolver; do not defer patching internet-facing resolvers.
Restrict recursion to trusted client networks using allow-recursion and allow-query-cache access control lists.
Apply per-client rate limiting on recursive queries to reduce the impact of abusive query bursts.

Patch Information

ISC has released fixed versions in the ISC BIND 9.20.29 Release and ISC BIND 9.21.26 Release. Operators of the 9.18.x branch and the -S1 Supported Preview branches should consult the ISC CVE-2026-81736 Documentation for the corresponding fixed builds and upgrade guidance.

Workarounds

Limit recursive service to authenticated or internal clients only, blocking untrusted sources at the network edge.
Apply Response Rate Limiting and query rate controls to constrain per-client CPU cost on SVCB/HTTPS query floods.
Where operationally acceptable, deploy resolver redundancy so a CPU-exhausted instance can fail over to healthy peers while patching proceeds.

bash

# Configuration example: restrict recursion and rate-limit clients in named.conf
acl "trusted" { 10.0.0.0/8; 192.168.0.0/16; };

options {
    recursion yes;
    allow-recursion { trusted; };
    allow-query-cache { trusted; };

    rate-limit {
        responses-per-second 20;
        window 5;
    };
};