CVE-2026-81736

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response, leading to a denial of service (DoS) condition. This can make the affected BIND 9 resolver unresponsive to legitimate requests.

This is an Important denial of service vulnerability in BIND 9 resolvers. An attacker can remotely trigger excessive CPU consumption by querying a resolver that has cached a specific tree of SVCB/HTTPS AliasMode records. This can lead to service disruption, particularly for resolvers exposed to untrusted networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the risk of this denial of service, configure BIND resolvers to restrict recursive queries to trusted clients only. This can be achieved by setting the allow-recursion option in the named.conf configuration file to specific IP addresses or networks. After modifying the configuration, the named service must be reloaded for the changes to take effect, which may temporarily interrupt DNS resolution.