This vulnerability, identified as CWE-408 (Incorrect Behavior Order), affects ISC BIND 9 DNS resolvers. It causes an amplified resource consumption or exhaustion condition when a resolver processes queries to specially crafted zones. The affected versions include 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and their S1 variants. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but an availability impact. No patch or vendor advisory with remediation details is currently available.

The vulnerability can lead to denial of service conditions by causing the BIND 9 resolver to consume excessive resources when querying maliciously crafted DNS zones. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild, so the immediate risk is limited to potential resource exhaustion attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider monitoring resolver resource usage and applying any recommended configuration changes from ISC once available. No vendor advisory or official remediation level is currently provided.