A critical denial of service vulnerability in ISC BIND 9 allows remote, unauthenticated attackers to crash the DNS resolver by triggering an assertion failure.

This vulnerability is a reachable assertion failure (CWE-617) occurring in the named daemon when specific configurations for stale answers are enabled. The flaw can be triggered by an unauthenticated attacker sending a crafted DNS query that forces the resolver to process a specific CNAME chain.

The successful exploitation of this vulnerability results in an immediate denial of service, as the named daemon will abort upon encountering the flawed CNAME logic. Given that DNS is a foundational service for network connectivity and application availability, an outage of the resolver would cause significant business disruption. The CVSS score of 7.5 reflects the high impact on service availability and the ease of exploitation by unauthenticated remote actors.

Immediate Action: Upgrade to the patched BIND 9 releases provided by ISC: 9.20.11, 9.21.10, or 9.20.11-S1.

Proactive Monitoring: Monitor system logs for repeated assertion failures or sudden restarts of the named process, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not possible, disable the serve-stale-enable feature in the named configuration to remove the trigger condition for this assertion failure.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the affected versions of ISC BIND 9 must prioritize patching to the recommended versions to eliminate the risk of service disruption. Due to the critical role of DNS in enterprise environments, the deployment of updates should be scheduled as soon as testing permits to prevent potential denial of service attacks against your name resolution services.