High severity7.5NVD Advisory· Published Sep 16, 2026· Updated Sep 17, 2026
CVE-2026-81736
CVE-2026-81736
Description
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17- osv-coords16 versionspkg:rpm/almalinux/bindpkg:rpm/almalinux/bind-chrootpkg:rpm/almalinux/bind-develpkg:rpm/almalinux/bind-dnssec-utilspkg:rpm/almalinux/bind-docpkg:rpm/almalinux/bind-libspkg:rpm/almalinux/bind-licensepkg:rpm/almalinux/bind-utilspkg:rpm/almalinux/bind9.18pkg:rpm/almalinux/bind9.18-chrootpkg:rpm/almalinux/bind9.18-develpkg:rpm/almalinux/bind9.18-dnssec-utilspkg:rpm/almalinux/bind9.18-docpkg:rpm/almalinux/bind9.18-libspkg:rpm/almalinux/bind9.18-utilspkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweed
< 32:9.18.33-15.el10_2.12+ 15 more
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.33-15.el10_2.12
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 32:9.18.29-14.el9_8.10
- (no CPE)range: < 9.20.29-1.1
Patches
Vulnerability mechanics
References
3News mentions
3- ISC Patches 14 Vulnerabilities in BIND 9 Security UpdateSecurityWeek · Sep 17, 2026
- BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPSThe Hacker News · Sep 17, 2026
- ISC Patches 14 BIND 9 Vulnerabilities, Primarily Causing Denial-of-ServiceVypr Intelligence · Sep 16, 2026