![isc bind]()
CVE-2026-81736 is a vulnerability in ISC BIND
Published on September 16, 2026
Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.
This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Vulnerability Analysis
CVE-2026-81736 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Excessive Platform Resource Consumption within a Loop
The software has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
Products Associated with CVE-2026-81736
Want to know whenever a new CVE is published for ISC BIND? stack.watch will email you.
Affected Versions
ISC BIND 9:- Version 9.18.0, <= 9.18.50 is affected.
- Version 9.20.0, <= 9.20.27 is affected.
- Version 9.21.0, <= 9.21.25 is affected.
- Version 9.18.11-S1, <= 9.18.50-S1 is affected.
- Version 9.20.9-S1, <= 9.20.27-S1 is affected.