The vulnerability is an unbounded resend loop in the resolver state machine during bad-server handling, which allows a remote unauthenticated attacker to send specially crafted queries that trigger retry conditions. This vulnerability is a CWE-606 type flaw (Missing Input Validation) and a CWE-835 type flaw (Uncontrolled Loop or Recursion) and causes the resolver to repeatedly send and receive answers, rapidly consuming CPU, memory, and network bandwidth. The impact is a denial of service at the system or network level, degrading the availability of the DNS service and potentially impacting downstream clients that rely on it.

BIND 9, a DNS server developed by ISC. The affected releases are 9.18.36‑48, 9.20.8‑22, 9.21.7‑21 and their corresponding security‑fixed branches. Systems running any of these versions are vulnerable.

The CVSS score of 5.3 reflects moderate severity, with an EPSS score of <1% and the issue not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is a remote attacker sending DNS queries over the network to a BIND 9 instance that can be reached without authentication. Once the retry loop is triggered, the BIND instance will consume resources until the process stalls or the system becomes unresponsive. The exploit requires no special privileges and can be executed purely by sending network traffic to the target.