This vulnerability arises from improper filtering of special elements (CWE-790) in ISC BIND 9's RPZ processing. When a resolver uses RPZ with wildcard CNAME policies, an attacker can send query names long enough to cause a NAMETOOLONG error. The error is not handled correctly, which may allow the attacker to defeat the RPZ rule enforcement or cause an unexpected termination of the BIND 9 process. The affected versions include 9.16.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and specific S1 builds. No official patch or remediation level has been published as of the data provided.

Successful exploitation can lead to bypassing RPZ rules, which are used to enforce DNS response policies, potentially allowing malicious DNS responses to be served. Additionally, it may cause the BIND 9 software to exit unexpectedly, leading to denial of service conditions. The CVSS score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should monitor ISC advisories for updates. No vendor advisory or official fix has been provided in the input data. No specific mitigations are documented beyond awaiting an official patch.