BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

The Internet Systems Consortium (ISC) patched 14 vulnerabilities in BIND 9, including a critical flaw that allows any unauthenticated attacker to crash a DNS server by sending a single malformed DNS-over-HTTPS request — no credentials or prior access required. DNS infrastructure is foundational to nearly all internet-facing services, meaning an exploited crash can cause widespread outages affecting entire networks or organizations. Seven of the flaws carry a High CVSS score of 7.5, indicating significant risk of denial-of-service at scale. This incident highlights how unpatched DNS software becomes an easy, high-impact target, and that even protocol-level features like DoH can introduce new attack surfaces if not carefully hardened and kept up to date.