BIND 9 servers that use GSS-API based TKEY authentication are susceptible to excessive memory consumption when they receive specially crafted packets. An attacker can trigger a memory exhaustion condition by sending a sequence of these packets, which can cause the server to block or crash, thereby denying DNS services to legitimate clients. This vulnerability is categorized as a resource management weakness (CWE-771) and can compromise availability.

The affected product is ISC BIND 9. Versions from 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, as well as the corresponding -S1 releases, are vulnerable. Customers running these releases in Active Directory integrated or Kerberos-secured environments should review their deployment.

The base CVSS score is 7.5, indicating a high severity level. The EPSS score of 0.00052 (less than 1%) suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote over the network; the attacker merely needs to craft malformed GSS-API TKEY packets and send them to the server. Because no workaround exists, the vendor recommends applying the official patch releases: 9.18.49, 9.20.23, 9.21.22 or their security-specific equivalents.