A specially crafted domain name can trigger a memory leak in the DNS resolver component of ISC BIND 9. The leak occurs during the preparation of DNSSEC proofs of non‑existence, causing unchecked allocation that gradually consumes available memory. Over time this can exhaust system resources, leading to crashes or reduced performance and effectively denying service to legitimate queries. The weakness corresponds to improper resource handling (CWE‑772).

ISC BIND 9 on all operating systems, specifically versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9‑S1 through 9.20.20‑S1. Versions 9.18.0‑9.18.46 and 9.18.11‑S1‑9.18.46‑S1 are not affected.

The vulnerability scores a CVSS 7.5, indicating high impact. The EPSS score is 0.047%, which is less than 1%, indicating a very low but nonzero likelihood of exploitation, and it is not listed in the CISA KEV catalog. Attackers can trigger the issue remotely by issuing DNS queries that reference a malicious domain name, leveraging any publicly reachable BIND resolver. The requirement is only network access to the resolver; no authentication or privileged state is needed. Consequently, the risk is significant for exposed DNS servers.