BIND 9 resolvers can be abused to launch an amplified resource consumption attack when a resolver queries a specially crafted zone that contains self‑pointed glue records. The resolver processes the unusual response, allocating disproportionate amounts of memory and CPU, which can overwhelm the server. The weakness involves resource exhaustion (CWE‑408) and an out‑of‑memory condition (CWE‑770).

ISC BIND 9 servers that run any of the following version ranges are affected: 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, the corresponding security releases 9.11.3‑S1 through 9.16.50‑S1, 9.18.11‑S1 through 9.18.48‑S1, and 9.20.9‑S1 through 9.20.22‑S1.

The CVSS score of 5.3 indicates moderate severity affecting availability. The EPSS score of less than 1% implies that the likelihood of exploitation is very low, and the vulnerability is not listed in CISA KEV, suggesting limited real‑world attacks. The likely attack vector involves a remote DNS client that sends queries to a resolver for a specially crafted zone containing self‑pointed glue records; the resolver processes the amplified response, consuming excessive memory and CPU and potentially exhausting system resources. While the weakness involves resource exhaustion (CWE‑408) and an out‑of‑memory condition (CWE‑770), network‑level defenses such as rate limiting or blocking self‑pointed glue records can mitigate the impact, but the most effective mitigation is to apply the vendor‑released patch.