BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

Summary

The Internet Systems Consortium released BIND 9.20.29 and 9.21.26 to fix 14 security vulnerabilities disclosed on September 16, 2026. One critical flaw allows unauthenticated attackers to crash BIND servers over DNS-over-HTTPS (DoH) by sending a single malformed request with an invalid SIG(0) signature. ISC rates 7 flaws as High severity (CVSS 7.5) involving denial-of-service conditions, while the remaining 7 are Medium severity affecting DNS data integrity and DNSSEC validation.

Full text

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS Swati KhandelwalSep 17, 2026Vulnerability / DNS Security The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature. ISC said in its advisories that it is not aware of any of the fourteen being exploited. Which Release Fixes What The fixed releases, described in ISC's release notes, are: BIND 9.20.29, on the current stable branch: fixes all fourteen BIND 9.21.26, on the development branch: fixes thirteen, because CVE-2026-19662 does not affect 9.21 BIND 9.20.29-S1, the Supported Preview Edition for support customers: fixes all fourteen ISC lists no workarounds for any of the fourteen. Twelve of the fourteen also affect the older 9.18 branch, up to and including 9.18.50, its final release. ISC ended support for 9.18 at the end of June and lists no 9.18 release that fixes them. ISC said in May that 9.18 users should plan to update to 9.20 as soon as possible. Its vulnerability matrix adds that "EOL versions should be assumed to be vulnerable to new CVEs." Operating-system packages are a separate matter. Debian 12 ships a package based on 9.18.49, and its security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September. What an Attacker Needs Two of the fourteen can be triggered by a request alone, without the attacker needing a DNS server of their own, and both affect only the 9.20 and 9.21 branches. The DoH crash is CVE-2026-77692. The second, CVE-2026-76163, lets a query of type TKEY crash named when the server's named.conf has no global options block. The other crashes need a recursive resolver, the kind of server that looks up names on behalf of clients, to receive crafted data from a server the attacker controls. A single crafted response can crash a resolver on a default configuration (CVE-2026-19667), a resolver using dns64 with break-dnssec yes (CVE-2026-19666), or a validating resolver that receives a wildcard answer carrying both NSEC and NSEC3 proofs (CVE-2026-80274). A fourth, CVE-2026-19662, needs a particular order and timing of answers and does not affect 9.21. Four more use up a resolver's CPU or memory instead of crashing it, two of them through cached SVCB/HTTPS alias records (CVE-2026-81563 and CVE-2026-81736). ISC rates seven of the fourteen High, all at 7.5 on CVSS 3.1: the crashes above except CVE-2026-19662, plus the two SVCB/HTTPS flaws. The other seven are Medium, from 5.3 to 6.5. The remaining four flaws concern the integrity of DNS data, what a server serves or what a resolver accepts, rather than crashes or exhaustion. ISC rates all four Medium, and each comes with conditions on where the attacker sits or what they already control. Two let a validating resolver accept the wrong DNSSEC proof. With CVE-2026-19941, a signed NSEC record from an unrelated zone can pass as proof that no wildcard exists. An on-path attacker, or a malicious forwarder, that controls a signed zone could use that to get a forged NXDOMAIN answer accepted for a name that should resolve through a wildcard, and the answer would pass DNSSEC validation. With CVE-2026-77119, a signed NSEC3 record from an unrelated sibling zone can pass as proof that a delegation is unsigned. An attacker able to inject responses to the resolver's queries could then get a forged unsigned answer accepted for names beneath that delegation. ISC describes both outcomes as cache poisoning. CVE-2026-19033 concerns a secondary server that copies a zone from a primary and accepts only transfers signed with a TSIG key. During a multi-message incremental transfer (IXFR) over TCP, named could start serving the new zone data before the final message carrying the signature arrived, and did not roll back if that signature never came. A party able to deliver such a transfer could get unauthorized zone contents served without holding the key. The fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice. CVE-2026-78301 needs more access: an attacker who can get a malformed zone loaded onto an authoritative server, for example through a zone transfer. A zone containing an NS or DNAME node above its own origin is then treated as a zone cut, so queries for names inside the zone return an out-of-zone delegation instead of the zone's data. If the server also recurses, it can follow delegation and cache attacker-supplied records for names outside the zone, and the effect lasts as long as the malformed zone remains loaded. The Fourteen Flaws CVE ISC score Effect Condition Affected (open source) Fixed in CVE-2026-77692 7.5 High Crash of named Server answers DoH. Invalid SIG(0) request, connection closed early 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-76163 7.5 High Crash of named TKEY query. named.conf has no global options block 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19667 7.5 High Crash of resolver Crafted negative answer of exactly 65536 bytes from an attacker-run server. Default configuration 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19666 7.5 High Crash of resolver dns64 with break-dnssec yes. Malformed answer served from cache 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-80274 7.5 High Crash of resolver, SERVFAIL, or wrong denial record served Validating resolver. Wildcard answer with both NSEC3 and unsigned NSEC at the same name 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19662 5.9 Medium Crash of resolver Attacker-run signed zone. Specific answer order and timing 9.11.0 through 9.18.50, 9.20.0 through 9.20.27 9.20.29 CVE-2026-81563 7.5 High Cache grows past its limit until resolution fails Resolver follows an SVCB/HTTPS alias with more than 13 target records, repeatedly 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-81736 7.5 High CPU exhaustion on resolver Cached SVCB/HTTPS alias tree. Client allowed recursion plus attacker-run zone 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19668 5.3 Medium CPU exhaustion on validating resolver Zone with many key tags and no valid match. ISC says default record limits reduce exposure 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-75029 5.3 Medium Memory use beyond configured limits Response repeats the same SOA, CNAME or DNAME record many times 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19941 5.9 Medium Forged NXDOMAIN accepted, which ISC calls cache poisoning Validating resolver. Attacker controlling a signed zone at the same or an upstream level, on-path or as a forwarder 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-77119 5.9 Medium Secure delegation downgraded, forged unsigned answer accepted Validating resolver. Attacker able to inject responses 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-19033 6.5 Medium Unauthorized zone data served by a secondary TSIG-restricted transfers. Multi-message TCP IXFR delivered by the attacker 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25 9.20.29, 9.21.26 CVE-2026-78301 5.8 Medium Out-of-zone data served as authoritative, and cache poisoning if the server also recurse

Indicators of Compromise

• cve — CVE-2026-77692
• cve — CVE-2026-76163
• cve — CVE-2026-19667
• cve — CVE-2026-19666
• cve — CVE-2026-80274
• cve — CVE-2026-19662
• cve — CVE-2026-81563
• cve — CVE-2026-81736
• cve — CVE-2026-19941
• cve — CVE-2026-77119
• cve — CVE-2026-19033

Entities