REDHAT-BUG-2535461: High severity Internet Systems Consortium BIND 9 vulnerability
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected Software
Event History
Frequently Asked Questions
Which resolver deployments are exposed to this issue?
BIND 9 resolvers running versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.27-S1 are affected.
What DNS data is required to trigger the resource leak?
The resolver must encounter an SVCB or HTTPS AliasMode record that references 14 or more SVCB or HTTPS ServiceMode records. Repeated encounters with such records can exhaust internal resources.
What is the operational impact if exploitation succeeds repeatedly?
Resource exhaustion can eventually prevent the resolver from performing new recursive lookups.