CVE-2026-81736
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Sep 16, 2026
CISA due date
—
The record
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85977 A flaw was found in libtirpc. CWE-1050
- CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19… CWE-1050
- CVE-2026-52681 Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid… CWE-1050
- CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. CWE-1050
- CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. CWE-1050
- CVE-2026-44390 NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling… CWE-1050
- CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of… CWE-1050
- CVE-2026-4634 A flaw was found in Keycloak. CWE-1050