BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH).

A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.

ISC said in its advisories that it is not aware of any of the fourteen being exploited.

Which Release Fixes What

The fixed releases, described in ISC's release notes, are:

• BIND 9.20.29, on the current stable branch: fixes all fourteen
• BIND 9.21.26, on the development branch: fixes thirteen, because CVE-2026-19662 does not affect 9.21
• BIND 9.20.29-S1, the Supported Preview Edition for support customers: fixes all fourteen

ISC lists no workarounds for any of the fourteen.

Twelve of the fourteen also affect the older 9.18 branch, up to and including 9.18.50, its final release. ISC ended support for 9.18 at the end of June and lists no 9.18 release that fixes them.

ISC said in May that 9.18 users should plan to update to 9.20 as soon as possible. Its vulnerability matrix adds that "EOL versions should be assumed to be vulnerable to new CVEs."

Operating-system packages are a separate matter. Debian 12 ships a package based on 9.18.49, and its security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September.

What an Attacker Needs

Two of the fourteen can be triggered by a request alone, without the attacker needing a DNS server of their own, and both affect only the 9.20 and 9.21 branches. The DoH crash is CVE-2026-77692. The second, CVE-2026-76163, lets a query of type TKEY crash named when the server's named.conf has no global options block.

The other crashes need a recursive resolver, the kind of server that looks up names on behalf of clients, to receive crafted data from a server the attacker controls.

A single crafted response can crash a resolver on a default configuration (CVE-2026-19667), a resolver using dns64 with break-dnssec yes (CVE-2026-19666), or a validating resolver that receives a wildcard answer carrying both NSEC and NSEC3 proofs (CVE-2026-80274). A fourth, CVE-2026-19662, needs a particular order and timing of answers and does not affect 9.21.

Four more use up a resolver's CPU or memory instead of crashing it, two of them through cached SVCB/HTTPS alias records (CVE-2026-81563 and CVE-2026-81736). ISC rates seven of the fourteen High, all at 7.5 on CVSS 3.1: the crashes above except CVE-2026-19662, plus the two SVCB/HTTPS flaws. The other seven are Medium, from 5.3 to 6.5.

The remaining four flaws concern the integrity of DNS data, what a server serves or what a resolver accepts, rather than crashes or exhaustion. ISC rates all four Medium, and each comes with conditions on where the attacker sits or what they already control.

Two let a validating resolver accept the wrong DNSSEC proof. With CVE-2026-19941, a signed NSEC record from an unrelated zone can pass as proof that no wildcard exists. An on-path attacker, or a malicious forwarder, that controls a signed zone could use that to get a forged NXDOMAIN answer accepted for a name that should resolve through a wildcard, and the answer would pass DNSSEC validation.

With CVE-2026-77119, a signed NSEC3 record from an unrelated sibling zone can pass as proof that a delegation is unsigned. An attacker able to inject responses to the resolver's queries could then get a forged unsigned answer accepted for names beneath that delegation. ISC describes both outcomes as cache poisoning.

CVE-2026-19033 concerns a secondary server that copies a zone from a primary and accepts only transfers signed with a TSIG key. During a multi-message incremental transfer (IXFR) over TCP, named could start serving the new zone data before the final message carrying the signature arrived, and did not roll back if that signature never came. A party able to deliver such a transfer could get unauthorized zone contents served without holding the key.

The fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice.

CVE-2026-78301 needs more access: an attacker who can get a malformed zone loaded onto an authoritative server, for example through a zone transfer. A zone containing an NS or DNAME node above its own origin is then treated as a zone cut, so queries for names inside the zone return an out-of-zone delegation instead of the zone's data.

If the server also recurses, it can follow delegation and cache attacker-supplied records for names outside the zone, and the effect lasts as long as the malformed zone remains loaded.

The Fourteen Flaws

The Supported Preview Edition is affected in the matching -S1 ranges and is fixed in 9.20.29-S1. Scores are ISC's own CVSS 3.1 ratings.

Exploitation Status and Public Tests

Each of ISC's fourteen advisories, published on 16 September, says it is "not aware of any active exploits." None of the fourteen appears in CISA's Known Exploited Vulnerabilities catalog as of the catalog version released the same day.

Tests that reproduce the flaws are public, though. ISC said in May that it now releases reproduction tests when it publishes a vulnerability, and the 9.20.29 source tree adds system tests for at least six of the fourteen, including one that sends an invalid SIG(0) request over DoH, closes the connection, and checks that named survives.

These are tests that confirm the fix, not attack tools, but they spell out the trigger conditions.

Fourteen is the largest of ISC's five BIND security releases this year, after one flaw in January, four in March, six in May and nine in July.

ISC warned in May that "users should expect security fixes in every monthly BIND maintenance release" for the rest of 2026, a change it said was driven by a flood of vulnerability reports generated by large language models, by researchers and attackers alike.

The fixes arrive in 9.20.29 rather than 9.20.28 because ISC withdrew 9.20.28 before release after pre-release testing found a regression.

Four of the fourteen were found in ISC's own testing. The rest were reported by Vitaly Simonovich (CVE-2026-77692), Rintaro Kawasugi (CVE-2026-19666 and CVE-2026-19667), Samy Medjahed (Ap4sh) (CVE-2026-19662 and CVE-2026-81563), Henrique Pereira (CVE-2026-78301 and CVE-2026-81736), Owais Lone (thesecguy) (CVE-2026-76163), a researcher credited as hythyt (CVE-2026-80274), and Zuyao Xu and Xiang Li of Nankai University (CVE-2026-19668).

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.