Loading story…
ISC disclosed CVE-2026-81736, a high-severity remote denial-of-service flaw in BIND 9 recursive resolvers. When an affected resolver has cached a tree of SVCB or HTTPS AliasMode records, an unauthenticated attacker can query the tree root and trigger disproportionate CPU consumption during response construction, potentially exhausting system resources and disrupting DNS resolution.
ISC assigned the vulnerability a CVSS v3.1 score of 7.5 and reported no known active exploitation. Organizations running affected BIND 9 resolvers should upgrade to the applicable patched release from ISC; no workaround is currently available.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
ISC publicly disclosed CVE-2026-81736, a high-severity (CVSS 7.5) unauthenticated remote denial-of-service vulnerability affecting multiple BIND 9 release ranges. ISC stated that no workaround was known, recommended upgrading to a related patched release, and reported no known active exploitation at disclosure.
ISC revised the list of BIND 9 versions fixed for CVE-2026-81736.
ISC issued an early notification for CVE-2026-81736, a remotely exploitable CPU denial-of-service flaw in BIND 9 resolvers involving cached SVCB/HTTPS AliasMode record trees.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, CVE-2025-40778, has been identified in BIND 9 DNS resolvers, exposing over 706,000 servers worldwide to cache poisoning attacks. The flaw, which carries a CVSS v3.1 score of 8.6, allows remote, unauthenticated attackers to inject forged DNS records into resolver caches by exploiting BIND's overly permissive acceptance of certain DNS records in responses. This manipulation can redirect internet traffic to malicious sites, facilitate malware distribution, or enable interception of network communications, posing a significant risk to global DNS infrastructure. The Internet Systems Consortium (ISC) has released advisories and patches addressing the vulnerability in multiple supported and preview versions of BIND 9, including versions 9.18.41, 9.20.15, and 9.21.14, as well as corresponding Supported Preview Edition releases. The publication of proof-of-concept exploit code has heightened the urgency for administrators to patch affected systems, particularly those running recursive DNS servers. While no active exploitation has been observed yet, the widespread use of BIND 9 and the critical nature of DNS services make prompt remediation essential to prevent large-scale attacks.
Jun 29, 2026
ISC disclosed **CVE-2025-40777**, a high-severity denial-of-service flaw in BIND 9 that can cause `named` to exit during recursive lookups when the resolver is configured as a caching resolver with serve-stale enabled and `stale-answer-client-timeout 0`. The bug is triggered by a specific CNAME resolution path involving stale cache behavior and can be exploited remotely against affected resolvers; authoritative-only deployments are not believed to be impacted. ISC assigned the issue **CVSS 7.5** and **CWE-617**, said there was no known active exploitation, and identified affected releases as **BIND 9.20.0 through 9.20.10**, **9.21.0 through 9.21.9**, and Supported Preview Edition builds. Related BIND bug reports show the same configuration also caused stale RRsets in CNAME chains to be mishandled, with refresh queries missing or incomplete and logs incorrectly reporting stale-answer activity for records that were not yet stale. ISC said fixes and regression tests were prepared through its coordinated release process, with the vulnerability addressed in **9.20.11** and **9.21.10** and the stale-refresh bug later fixed in **9.20.12** and **9.21.11**. As a workaround, ISC advised operators to upgrade or disable the vulnerable stale-answer settings until patched versions are deployed.
Jul 10, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026