This vulnerability involves inefficient algorithmic complexity (CWE-407) in ISC BIND 9 recursive resolver implementations. When encountering large quantities of a specific type of invalid DNSSEC record, the resolver may consume excessive resources, potentially impacting availability. The vulnerability affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and corresponding S1 variants. Default configuration limits on "max-records-per-type" and "max-types-per-name" provide some mitigation against exploitation. No known exploits are reported in the wild. No explicit patch or fix information is provided in the available data.

The impact is limited to potential denial of service through resource exhaustion in the recursive resolver due to inefficient processing of malformed DNSSEC records. There is no confidentiality or integrity impact reported. The CVSS score of 5.3 reflects a medium severity denial of service risk without required privileges or user interaction.

Default limits on "max-records-per-type" and "max-types-per-name" in BIND 9 configurations help mitigate this vulnerability. Since no patch or official fix information is provided, users should verify vendor advisories for updates. Monitoring and adjusting these limits may reduce exposure. Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance.