BIND 9 resolvers can be abused to launch an amplified resource consumption attack when a resolver queries a specially crafted zone that contains self‑pointed glue records. The resolver will process the response and allocate disproportionately large amounts of memory and CPU, potentially leading to a denial of service. The weakness is classified as resource exhaustion (CWE‑408).

ISC BIND 9 servers that run any of the following version ranges are affected: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, the corresponding security releases 9.11.3‑S1 through 9.16.50‑S1, 9.18.11‑S1 through 9.18.48‑S1, and 9.20.9‑S1 through 9.20.22‑S1.

The CVSS score of 5.3 indicates a moderate severity that can affect availability. While no EPSS score is available, the lack of a KEV listing suggests limited, mitigated exploitation. The attack likely originates from a remote DNS client that can send queries to the resolver, which then processes an amplified response from a malicious zone. Network‑level defenses such as rate limiting or blocking self‑pointed glue records can reduce the impact, but the primary mitigation is to apply a vendor‑released patch.