CVE-2026-81563: SVCB AliasMode additional-data error leaks qpcache references
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.26 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.29-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BIND 9 resolvers running versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1 are affected. The impact is exhaustion of resolver resources, preventing new recursive lookups.
What must an attacker do to trigger the resource exhaustion?
The resolver must encounter an SVCB or HTTPS AliasMode record that references 14 or more SVCB or HTTPS ServiceMode records. Repeated triggering causes internal resources not to be properly deallocated.
Does exploitation require authentication or user interaction?
No. The supplied vector identifies the issue as network-reachable with low attack complexity, requiring no privileges or user interaction.