A high-severity denial of service vulnerability in ISC BIND 9 allows unauthenticated attackers to exhaust system CPU resources via malicious DNS queries.

This is an asymmetric resource consumption vulnerability (CWE-405) that triggers excessive CPU usage when the service processes malformed DNSKEY records. The attack is unauthenticated and can be triggered remotely by any user capable of sending DNS queries to the affected server.

Successful exploitation of this flaw results in a denial of service condition, potentially rendering the DNS infrastructure unresponsive. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to network availability and business continuity for organizations relying on BIND 9 for critical name resolution services.

Immediate Action: Upgrade to the patched release corresponding to your current deployment: BIND 9.18.41, 9.20.15, 9.21.14, 9.18.41-S1, or 9.20.15-S1.

Proactive Monitoring: Monitor server CPU utilization and DNS query logs for spikes or patterns of anomalous requests targeting specific zones.

Compensating Controls: Implement rate limiting on DNS queries at the network perimeter to mitigate the impact of high-volume malicious traffic while patches are pending.

Public Exploit Available: No (exploit_available: false)

The risk posed by this denial of service vulnerability is substantial, particularly for public-facing DNS resolvers. Administrators should prioritize the deployment of the provided security updates immediately to protect against potential service outages and ensure the ongoing stability of their DNS infrastructure.