CVE-2026-81736Not scored

CVE-2026-81736: Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

ISC · BIND 9

Vendor fix available · Affected: ISC BIND 9 · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.6%probability of exploitation in the next 30 days

47th percentile

050100

Higher than 47% of scored CVEs

Not scored yet. NVD has not published a CVSS score.

DescriptionNVD

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Excessive Platform Resource Consumption within a Loop · Denial of Service
Vendor: ISC
Published: September 2026
Band: Unlikely (under 1%), September 2026

Coverage1 article · 1 outlet

First in our coverage: SecurityWeek, 17 Sep.

17 Sep 13:01
ISC Fixes 14 BIND Flaws Allowing Remote DNS Server Crashes
SecurityWeek · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.