UBUNTU-CVE-2026-81563: High severity ubuntu/isc-dhcp vulnerability

Q: Which resolver deployments are exposed?

BIND resolvers running affected version ranges are exposed when they perform recursive lookups. The affected ranges are 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Q: What must an attacker do to trigger the issue?

An attacker needs to cause the resolver to encounter an SVCB or HTTPS AliasMode record that references 14 or more SVCB or HTTPS ServiceMode records. Repeated triggering can exhaust resources and stop the resolver from performing new recursive lookups.

Q: How can I tell whether a resolver may be affected?

Check the running BIND version against the listed affected ranges and determine whether the server performs recursive lookups. The provided information does not specify a log signature or other definitive indicator that resource exhaustion has already occurred.

Published Sep 16, 2026

Updated

A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Affected Software

10 affected componentsFixes available

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.18.30-0ubuntu0.20.04.2+esm3

1:9.18.30-0ubuntu0.20.04.2+esm3

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.7

1:9.18.39-0ubuntu0.22.04.7

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.8

1:9.18.39-0ubuntu0.24.04.8

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.4

1:9.20.24-1ubuntu0.4

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.30-0ubuntu0.20.04.2+esm3
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.7
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.4

Event History

Sep 16, 2026

CVE Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which resolver deployments are exposed?

BIND resolvers running affected version ranges are exposed when they perform recursive lookups. The affected ranges are 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

What must an attacker do to trigger the issue?

An attacker needs to cause the resolver to encounter an SVCB or HTTPS AliasMode record that references 14 or more SVCB or HTTPS ServiceMode records. Repeated triggering can exhaust resources and stop the resolver from performing new recursive lookups.

How can I tell whether a resolver may be affected?

Check the running BIND version against the listed affected ranges and determine whether the server performs recursive lookups. The provided information does not specify a log signature or other definitive indicator that resource exhaustion has already occurred.

UBUNTU-CVE-2026-81563: High severity ubuntu/isc-dhcp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which resolver deployments are exposed?

What must an attacker do to trigger the issue?

How can I tell whether a resolver may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which resolver deployments are exposed?

What must an attacker do to trigger the issue?

How can I tell whether a resolver may be affected?