The vulnerability arises when a BIND resolver that validates DNSSEC encounters a malicious zone containing an excessive number of NSEC3 iterations. The resolver spends a large amount of CPU time processing the invalid NSEC3 proofs, which can exhaust server resources and lead to denial of service. This is a classic resource exhaustion flaw, reflected by CWE‑770. Only resolvers with DNSSEC validation enabled are vulnerable; authoritative‑only servers are normally unaffected unless they perform recursive queries.

The affected product is ISC BIND 9. All releases from 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, and 9.21.0 through 9.21.19, as well as their security patch releases 9.11.3‑S1 through 9.16.50‑S1, 9.18.11‑S1 through 9.18.46‑S1, and 9.20.9‑S1 through 9.20.20‑S1 are impacted.

The CVSS score of 7.5 indicates a high severity. Though the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the high CVSS coupled with the availability of a malicious zone makes exploitation plausible. Attackers can remotely trigger the issue by making the resolver query a crafted zone while DNSSEC validation is active, causing CPU exhaustion. The community recommends upgrading to the patched releases or, as a temporary measure, disabling DNSSEC validation to mitigate the risk.