CyberRota Analysis
AI-GeneratedBIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1 are vulnerable to a resource exhaustion flaw in DNSSEC validation, where excessive RRSIG records in a response can lead to significant CPU resource consumption. This vulnerability can result in denial-of-service conditions, impacting the availability of DNS services. Organizations using affected BIND versions should prioritize remediation to mitigate potential disruptions to their DNS infrastructure.
Original NVD Description
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and 9.20.9-S1 through 9.20.24-S1.