This vulnerability in ISC BIND 9 involves unchecked input for a loop condition (CWE-606) during DNSSEC validation by a resolver. When encountering a maliciously crafted DNS zone, the resolver may consume excessive CPU resources, leading to potential denial of service. The affected versions include BIND 9 releases from 9.11.0 to 9.21.19 and their S1 variants. Authoritative-only servers are mostly unaffected unless they perform recursive queries. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (CPU exhaustion).

The primary impact is excessive CPU consumption on BIND 9 resolvers performing DNSSEC validation when processing maliciously crafted zones. This can degrade resolver performance or cause denial of service conditions. There is no impact on confidentiality or integrity. Authoritative-only servers are generally unaffected unless they issue recursive queries, which is uncommon but possible. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance. In the absence of an official fix, consider limiting exposure of vulnerable BIND 9 resolvers to untrusted zones or networks. Monitor ISC communications for updates on patches or workarounds. Since authoritative-only servers are generally unaffected, focus mitigation efforts on recursive resolvers performing DNSSEC validation.