CVE-2026-75029: Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
In a query response, an attacker may send named multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running affected ISC BIND 9 versions are exposed when their named process handles query responses containing repeated identical singleton RDATA records. The affected ranges include 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
What must an attacker provide to trigger the memory growth?
An attacker must cause named to process a query response containing multiple copies of a record that should occur only once, such as an SOA record, with identical RDATA on every copy. The repeated records are appended to the in-memory RDATA set.
What is the practical impact?
Processing these responses can increase negative-cache memory usage and may lead to other memory attack vectors. The stated availability impact is low.