The Internet Systems Consortium (ISC) disclosed 14 security vulnerabilities in BIND 9, its widely deployed open-source DNS server software, on September 16, 2026, and released BIND 9.20.29 and 9.21.26 to fix them. The standout issue affects any BIND server configured to answer DNS-over-HTTPS (DoH) queries: an unauthenticated sender can crash the named process with a single crafted request, no credentials or prior access required.
What Was Fixed
ISC's advisories split the batch roughly in half by severity: seven flaws rated 7.5 High, capable of denial-of-service through process crashes, memory exhaustion, or unexpected termination, and seven more rated in the 5.3 to 6.5 Medium range, covering issues like cache poisoning, elevated memory or CPU usage, and arbitrary data injection. ISC said it is "not aware of any active exploits" for any of the fourteen as of disclosure, and none appeared in CISA's Known Exploited Vulnerabilities catalog on the day of release.
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-77692 | Unauthenticated crash of named via a single DoH request carrying an invalid SIG(0) signature, closed before verification completes | 7.5 High |
| CVE-2026-76163 | A TKEY-type query can crash named when named.conf has no global options block | 7.5 High |
| CVE-2026-77119 | A validating resolver can incorrectly accept an NSEC3 record from an unrelated sibling zone as proof a delegation is insecure, opening the door to cache poisoning; no workaround | 7.5 High |
| CVE-2026-78301 | Out-of-zone records in a zone database could be served as authoritative data or cause the server to follow an unintended delegation | Medium |
| CVE-2026-19033 | Secondary zones gating transfers behind TSIG could begin serving zone data before the final signed message arrived, with no rollback if it never came | Medium |
| CVE-2026-19667 / CVE-2026-19666 / CVE-2026-80274 | Crafted or malformed responses from an attacker-controlled upstream server can crash a recursive resolver in specific configurations (default resolver, dns64 with break-dnssec yes, or wildcard answers mixing NSEC and NSEC3 proofs) | High/Medium |
Additional lower-severity issues, including ones tied to SVCB/HTTPS AliasMode records and oversized negative answers, are addressed in the same release. Twelve of the fourteen also affect the older 9.18 branch (through its final release, 9.18.50), but ISC ended support for 9.18 at the end of June 2026 and has not issued a fix for it there.
The DNS-over-HTTPS Crash Bug
The flaw drawing the most attention is CVE-2026-77692, rated 7.5 (High) on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). ISC describes it as: a sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.
In practice, that means any client that can reach a BIND server's DoH listener can send one malformed request, terminate the connection mid-verification, and trigger an abnormal exit of the named process — no authentication, no valid DNS zone, and no attacker-controlled upstream server required. That combination (network-reachable, unauthenticated, single request) puts it in the same small category as CVE-2026-76163, the other flaw in this batch that needs nothing but a crafted query to crash the server.
The affected versions for CVE-2026-77692 are BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and BIND Supported Preview Edition 9.20.9-S1 through 9.20.27-S1. This is a denial-of-service issue, not a remote-code-execution bug — ISC's impact statement describes "abnormal program termination," with no indication of memory corruption leading to code execution.
Why It Matters
BIND 9 is one of the most widely deployed authoritative and recursive DNS server implementations on the internet, underpinning everything from enterprise internal resolvers to public-facing authoritative nameservers. DoH support in BIND exists specifically to let resolvers answer encrypted DNS queries over HTTPS, a feature increasingly enabled as organizations adopt encrypted DNS.
A pre-authentication, single-request denial-of-service bug in software this widely deployed is exactly the kind of issue that tends to attract opportunistic scanning once technical detail circulates — the 9.20.29 source tree already ships system tests that reproduce several of the fourteen flaws, including one that exercises an invalid SIG(0) request over DoH, which spells out the trigger conditions even without ISC publishing a full write-up. DNS resolver availability is foundational infrastructure: a crash loop against a production named process can take down name resolution for everything behind it, and repeated crashes are a hallmark pattern CISA has flagged as Known Exploited Vulnerability material once exploitation starts.
This is also part of a broader trend: ISC has now shipped five BIND security releases in 2026 (one flaw in January, four in March, six in May, nine in July, and fourteen now in September), and warned in May that users should expect security fixes in every monthly BIND maintenance release for the rest of the year.
Mitigation
- Upgrade immediately to BIND 9.20.29 or 9.21.26 (or 9.20.29-S1 for Supported Preview Edition customers) — ISC lists no workarounds for CVE-2026-19668 or CVE-2026-77119, making the update the only reliable fix for those two.
- Packaged/distro builds: if BIND is installed via a Linux distribution's package manager rather than built from ISC source, check for a vendor-specific backport before assuming you are unaffected — distro version numbers do not always match ISC's upstream releases directly.
- Disable the DoH listener as a stopgap if it is not actively in use, until the upgrade can be scheduled; this removes the CVE-2026-77692 attack surface entirely.
- Monitor for crash-loop or restart patterns in BIND logs and process supervisors (systemd, monit, container orchestrators) — repeated unexpected
namedrestarts are the primary indicator of active exploitation attempts against these flaws. - 9.18 users: that branch is end-of-life as of June 2026 and will not receive a fix for the twelve applicable flaws here — treat this as an additional forcing function to migrate to a supported branch.