BIND 9 Update Fixes 14 Security Flaws, Including DoH Crash Bug

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to address 14 security vulnerabilities in its widely used open-source DNS server software. One of the flaws can allow an unauthenticated attacker to crash a BIND server with a single request when the server handles DNS-over-HTTPS (DoH) traffic.

The vulnerability, tracked as CVE-2026-77692, can be triggered when an attacker sends an invalid SIG(0) signature and closes the connection before the named server process finishes checking the signature. No credentials are required to trigger the issue. ISC said it is not aware of any of the 14 vulnerabilities being exploited in the wild.

The new BIND releases address the vulnerabilities across the supported branches. BIND 9.20.29, the current stable release, fixes all 14 flaws, while BIND 9.21.26 fixes 13 because CVE-2026-19662 does not affect the 9.21 development branch. The Supported Preview Edition, BIND 9.20.29-S1, also fixes all 14 vulnerabilities. ISC lists no workarounds for the flaws.

The vulnerabilities affect different parts of BIND’s DNS functionality and can have different consequences depending on how a server is configured. Several can cause BIND’s resolver or server process to crash, while others can exhaust CPU or memory resources. Four additional vulnerabilities affect the integrity of DNS responses and zone data.

Two of the vulnerabilities can be triggered directly by a request without requiring the attacker to operate their own DNS server. CVE-2026-77692 affects servers that answer DNS-over-HTTPS requests and can cause named to crash. CVE-2026-76163 can also crash named when a TKEY query is received by a server whose named.conf configuration does not contain a global options block. Both vulnerabilities affect BIND 9.20 and 9.21.

Other crash vulnerabilities require a recursive resolver to receive specially crafted DNS data from a server controlled by the attacker. CVE-2026-19667 can crash a resolver when it receives a crafted negative response measuring exactly 65,536 bytes. CVE-2026-19666 affects configurations using DNS64 with break-dnssec yes, while CVE-2026-80274 can affect validating resolvers that process a wildcard response containing both NSEC and NSEC3 proofs. CVE-2026-19662 also affects resolvers but requires a particular sequence and timing of DNS responses.

Several other vulnerabilities can cause resource exhaustion rather than immediately crashing the server. CVE-2026-81563 can cause the resolver’s cache to grow beyond its limit when it follows certain SVCB or HTTPS alias records. CVE-2026-81736 can consume CPU resources through a cached SVCB/HTTPS alias tree. CVE-2026-19668 can also result in CPU exhaustion, while CVE-2026-75029 can cause memory usage to exceed configured limits.

ISC rates seven of the 14 vulnerabilities as High severity, with CVSS 3.1 scores of 7.5. These include the major crash and resource-exhaustion vulnerabilities, except CVE-2026-19662. The remaining seven are rated Medium, with scores ranging from 5.3 to 6.5.

The remaining vulnerabilities involve DNS data integrity. CVE-2026-19941 can allow a validating resolver to accept a signed NSEC record from an unrelated zone as proof that a wildcard does not exist. Under the conditions described by ISC, an on-path attacker or malicious forwarder controlling a signed zone could use the flaw to make a forged NXDOMAIN response pass DNSSEC validation. ISC describes the result as cache poisoning.

CVE-2026-77119 similarly affects DNSSEC validation. A signed NSEC3 record from an unrelated sibling zone can be accepted as proof that a delegation is unsigned. An attacker capable of injecting responses could then cause the resolver to accept a forged unsigned response. ISC also describes this as cache poisoning.

Another flaw, CVE-2026-19033, affects secondary DNS servers that use TSIG-signed zone transfers. During a multi-message incremental zone transfer over TCP, the server could begin serving updated zone data before receiving the final message containing the signature. If that signature never arrived, the server would not roll back the new data. The fix requires a TSIG signature on every message in an incoming transfer. ISC said modern name servers already sign every message, so it does not expect the change to have a practical impact on normal deployments.

CVE-2026-78301 requires more access because an attacker must first get a malformed zone loaded onto an authoritative DNS server, such as through a zone transfer. A specially crafted zone containing an NS or DNAME node above its own origin can be treated as a zone cut, causing queries to return an out-of-zone delegation instead of the expected zone data. If the server also performs recursion, it could follow the delegation and cache attacker-supplied records for names outside the zone.

BIND 9 Vulnerabilities Fixed in the Latest Releases

The older BIND 9.18 branch is also affected by 12 of the 14 vulnerabilities. However, ISC ended support for BIND 9.18 at the end of June and does not list a 9.18 release that fixes these vulnerabilities. ISC had previously advised users of BIND 9.18 to plan an upgrade to BIND 9.20, while its vulnerability matrix warns that end-of-life versions should be assumed vulnerable to new CVEs.

Operating-system packages can follow different release schedules. For example, Debian 12 ships a package based on BIND 9.18.49, and its security tracker had not listed any of these 14 vulnerabilities as of 06:20 UTC on September 17, according to the supplied source.

ISC said all 14 advisories published on September 16 stated that it was not aware of active exploitation. None of the vulnerabilities appeared in CISA’s Known Exploited Vulnerabilities catalog in the catalog version released that same day. However, public reproduction tests are available. ISC said these tests are intended to confirm the vulnerabilities and fixes rather than serve as attack tools, although they document the conditions needed to reproduce several issues.

The latest release is part of a busy year for BIND security updates. According to ISC, the project has issued five security releases in 2026, addressing one vulnerability in January, four in March, six in May, nine in July and now 14 in September. ISC previously warned that users should expect security fixes in every monthly BIND maintenance release for the remainder of 2026.

ISC said the increase in vulnerability reports was driven partly by security research involving large language models, alongside reports from researchers and attackers. The project also withdrew BIND 9.20.28 before release after pre-release testing discovered a regression, which is why the fixes were delivered in version 9.20.29 instead.

❤️

If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.

Support Us

Administrators running affected BIND versions should review their deployments and upgrade to a fixed supported release. For BIND 9.20 users, that means moving to 9.20.29, while users of the 9.21 development branch should move to 9.21.26. Organizations still running BIND 9.18 should also consider the branch’s end-of-life status and plan a move to a supported version.