An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
| Vendor | Product | Versions |
|---|---|---|
| isc | bind | 9.18.36, 9.20.8, 9.21.7, 9.18.36-S1, 9.20.9-S1 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| internet systems consortium | bind | cert_advisory | 90% |
Updated exploit availability to true, marked as actively exploited, and added new CVE tags.
Updated affected versions to include 9.18.48, 9.18.48-S1, 9.20.22, and 9.20.22-S1, and noted that no exploit is available.
Initial creation
