title: Processing large delegations may severely degrade resolver performance
description: By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
problem types: In BIND 9.0.0 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.9.3-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a flaw in resolver code can cause named to spend excessive amounts of time on processing large delegations.
affected:
{
vendor: ISC
product: BIND9
versions:
version: Open Source Branches 9.0 through 9.16 9.0.0 through versions before 9.16.33, status: affected
version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7, status: affected
version: Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions up to and including 9.11.37-S1, status: affected
version: Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1, status: affected
version: Development Branch 9.19 9.19.0 through versions before 9.19.5, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
]
exploits: We are not aware of any active exploits.
solutions: Upgrade to the patched release most closely related to your current version of BIND: BIND 9.16.33, BIND 9.18.7, BIND 9.19.5, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.16.33-S1.
workarounds: No workarounds known.