14 Flaws, Seven Rated High Severity
The Internet Systems Consortium (ISC) has released a security update for BIND 9, the most widely deployed open-source DNS server software, patching 14 vulnerabilities. Seven are rated high severity and seven medium severity. ISC reports no evidence of active exploitation for any of them, but recommends deploying the fixes promptly given BIND's foundational role in internet infrastructure.
High-Severity Flaws
The high-severity issues are remotely exploitable and can cause unexpected program termination, memory depletion, or denial-of-service conditions in the named daemon:
- CVE-2026-80274
- CVE-2026-76163
- CVE-2026-19666
- CVE-2026-81563
- CVE-2026-77692
- CVE-2026-19667
- CVE-2026-81736
One flaw, CVE-2026-77692, stands out for its exploitation path: an attacker can cause named to abort by sending a crafted DNS-over-HTTPS (DoH) request containing a cryptographically invalid SIG(0) record, then prematurely closing the transport connection before the server finishes processing it.
Medium-Severity Flaws
The seven medium-severity issues cover a different class of impact — rather than outright crashing the resolver, they can enable:
- Cache poisoning
- CPU exhaustion
- Packet loss
- Unauthorized data injection into zones
These are generally harder to weaponize for immediate disruption but can be chained with other techniques to degrade DNS integrity or availability over time.
Patched Versions
ISC has shipped fixes in:
- BIND 9.21.26
- BIND 9.20.29
Administrators running earlier 9.20.x or 9.21.x branches — or any BIND 9 deployment providing authoritative or recursive DNS service — should plan an upgrade. Given BIND's position as core internet infrastructure sitting on the critical path for name resolution, denial-of-service bugs against named carry outsized blast radius, particularly for ISPs, hosting providers, and enterprises running their own recursive resolvers.
Full technical details for each CVE are available in ISC's security advisories and the BIND 9 release notes.