BIND 9 Unbounded Resend Loop Vulnerability Causes Resource Exhaustion

A vulnerability allowing an unbounded resend loop has been identified in the BIND 9 resolver state machine. This issue arises during the handling of problematic servers, where a remote, unauthenticated attacker can send queries that trigger specific retry conditions, leading to severe resource exhaustion. The vulnerability affects BIND 9 versions 9.18.36 prior to 9.18.49, 9.20.8 prior to 9.20.23, 9.21.7 prior to 9.21.22, as well as BIND 9 Supported Preview Edition versions 9.18.36-S1 prior to 9.18.49-S1 and 9.20.9-S1 prior to 9.20.22-S1.

Impact

Exploitation of this vulnerability causes significant resource exhaustion on the affected resolver, which can lead to degraded performance or unresponsiveness.

Remediation

Users are advised to upgrade to BIND 9.18.49, 9.20.23, or 9.21.22. For those using BIND 9 Supported Preview Edition, upgrade to version 9.18.49-S1 or 9.20.23-S1.