CVE-2026-81563 SVCB AliasMode additional-data error leaks qpcache references
A remote attacker can cause resource exhaustion in the BIND resolver by sending specific SVCB records, preventing new recursive lookups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81563?
CVE-2026-81563 is a high-severity denial of service vulnerability in ISC BIND 9, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Weakness: CWE-401
Which versions are affected by CVE-2026-81563?
How do I fix CVE-2026-81563?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-81563 being exploited?
There is no known exploitation of CVE-2026-81563 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-81563, AZL-103347, BELL-CVE-2026-81563, DEBIAN-CVE-2026-81563, ECHO-8077-0c27-d434, GHSA-vrwj-p746-fr2r and 4 more.