VulnSocial

CVE-2026-81736Patch

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1050

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 2 signals
  • General: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-09-17); latest day: 2
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01223Mentions · 2026-09-16: 1Mentions · 2026-09-17: 3Mentions · 2026-10-06: 2Patch / Workaround · 2026-09-17: 2Patch / Workaround · 2026-10-06: 2Technical Details · 2026-09-17: 209-1609-1710-06
Signal classification2 categories
Patch
466.7%
General
233.3%
Referenced assets17 URLs
Classification over time
DateTotalLabels
2026-09-161
General1
2026-09-173
General1Patch2
2026-10-062
Patch2
Full discourse6 posts
  • Yasuhiro Morishita@OrangeMorishita
    General

    【自分用メモ】今月は14件。High7件。 https://kb.isc.org/docs/cve-2026-19033 https://kb.isc.org/docs/cve-2026-19662 https://kb.isc.org/docs/cve-2026-19666 https://kb.isc.org/docs/cve-2026-19667 https://kb.isc.org/docs/cve-2026-19668 https://kb.isc.org/docs/cve-2026-19941 https://kb.isc.org/docs/cve-2026-75029 https://kb.isc.org/docs/cve-2026-76163 https://kb.isc.org/docs/cve-2026-77119 https://kb.isc.org/docs/cve-2026-77692 https://kb.isc.org/docs/cve-2026-78301 https://kb.isc.org/docs/cve-2026-80274 https://kb.isc.org/docs/cve-2026-81563 https://kb.isc.org/docs/cve-2026-81736

    Post summary

    The tweet lists 14 CVE references for the month, noting 7 are high severity, but provides no details on PoC, exploit tools, active exploitation, patches, or technical vulnerability specifics.

    032821.6K
    4.6K followersView on X
  • 日本レジストリサービス（JPRS）@JPRS_official
    Patch

    （緊急）BIND 9.xの脆弱性（過剰なCPU負荷の誘発）について（CVE-2026-81736） - バージョンアップを強く推奨 - https://jprs.jp/tech/security/2026-09-17-bind9-vuln-aliasmode.html

    Post summary

    The alert highlights a BIND 9.x vulnerability (CVE-2026-81736) that can cause excessive CPU load and stresses the need to upgrade immediately. No PoC or exploit code is disclosed, but technical details are provided and a patch is urged.

    03051681
    1.3K followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:75578 - Important: bind9.18 security update [RHEL9] https://access.redhat.com/errata/RHSA-2026:75578 Security Fix(es): - CVE-2026-81736 - CVE-2026-19667 - CVE-2026-81563 - CVE-2026-80274 - CVE-2026-19666

    Post summary

    The post announces a Red Hat security update (RHSA-2026:75578) for bind9.18 that patches multiple CVEs, providing a clear remediation path.

    1000053
    118 followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:75577 - Important: bind security update [RHEL10] https://access.redhat.com/errata/RHSA-2026:75577 Security Fix(es): - CVE-2026-81736 - CVE-2026-19667 - CVE-2026-81563 - CVE-2026-80274 - CVE-2026-19666

    Post summary

    This is a Red Hat Security Advisory announcing a security update for bind, listing multiple CVEs and providing a link to the patch errata.

    1000087
    118 followersView on X
  • Yu F@fj_twt
    General

    🤮 cve-2026-19033 cve-2026-19662 cve-2026-19666 cve-2026-19667 cve-2026-19668 cve-2026-19941 cve-2026-75029 cve-2026-76163 cve-2026-77119 cve-2026-77692 cve-2026-78301 cve-2026-80274 cve-2026-81563 cve-2026-81736

    Post summary

    The text only lists multiple CVE identifiers with no additional context, technical details, remediation, or exploitation information. It serves as a generic mention of vulnerabilities without strong indicators for any specific classification.

    00010224
    1.6K followersView on X
  • Ryan Merck@rmerck
    Patch

    BIND CVE-2026-81736 burns resolver CPU on a cached SVCB/HTTPS AliasMode tree when someone queries the root of that tree. Easy to deprioritize next to RCE headlines. Get recursive fleets to 9.20.29 or 9.21.26. https://kb.isc.org/docs/cve-2026-81736

    Post summary

    The post describes CVE-2026-81736 in BIND, detailing its CPU exhaustion impact on cached SVCB/HTTPS AliasMode trees, and directs users to upgrade to versions 9.20.29 or 9.21.26 as a mitigation.

    0000042
    46 followersView on X

Explore more

Back to dashboard