ISC Patches 14 BIND 9 Vulnerabilities, Primarily Causing Denial-of-Service
ISC released updates for BIND 9, fixing 14 vulnerabilities, mostly leading to denial-of-service conditions, disclosed on September 16, 2026.
Key findings
- ISC patched 14 vulnerabilities in BIND 9, disclosed on September 16, 2026.
- Seven of the vulnerabilities are rated high severity and could lead to denial-of-service conditions.
- Flaws relate to DNSSEC validation, malformed records, and resource exhaustion.
- One vulnerability specifically targets DNS-over-HTTPS (DoH) requests.
- ISC is not aware of any of these vulnerabilities being actively exploited.
- Updates available in BIND 9.20.29 and 9.21.26.
Internet Systems Consortium (ISC) has released security updates for its widely-used BIND 9 DNS server software, addressing a batch of 14 vulnerabilities that were disclosed on September 16, 2026. The vulnerabilities, primarily leading to denial-of-service (DoS) conditions, range in severity from medium to high, with seven rated as high. These flaws could be exploited to cause unexpected program exits, memory exhaustion, named termination, and resource exhaustion.
Several of the high-severity vulnerabilities stem from how BIND handles DNSSEC validation and malformed DNS records. CVE-2026-80274, for instance, can trigger an unexpected program exit if a resolver receives a specific sequence of DNSSEC-signed and unsigned records. Similarly, CVE-2026-76163 can lead to an assertion failure and program exit when a BIND server, configured without a global options block, receives a query of QTYPE TKEY. Another high-severity flaw, CVE-2026-19666, affects resolvers configured with dns64 and can cause an unexpected exit if an authoritative server provides a malformed answer.
Resource exhaustion is another significant impact of these vulnerabilities. CVE-2026-81736 describes a scenario where cached SVCB/HTTPS AliasMode records can lead to disproportionate CPU time spent constructing responses, potentially impacting performance. CVE-2026-81563 details how encountering a large number of SVCB/HTTPS ServiceMode records can cause BIND to fail in deallocating internal resources, leading to exhaustion and preventing new lookups. CVE-2026-19668 also points to excessive resource consumption due to large numbers of invalid DNSSEC records, though default limits can mitigate this.
Other vulnerabilities include issues with NSEC records and zone data handling. CVE-2026-77119 allows a validly signed NSEC3 from an unrelated zone to be accepted as proof, potentially downgrading secure delegations. CVE-2026-75029 describes how receiving multiple copies of the same record in a query response can increase memory usage of the negative cache. CVE-2026-19941 involves an inapplicable NSEC record being accepted as proof of non-existence, potentially masking wildcards. CVE-2026-78301 can cause queries to lose authoritative status if a malformed zone contains an NS or DNAME node above its origin. CVE-2026-19667 details a crash caused by a negative answer of exactly 65536 bytes.
A notable vulnerability, CVE-2026-77692, specifically affects DNS-over-HTTPS (DoH) requests. An attacker can cause named to abort by sending a crafted DoH request with a cryptographically invalid SIG(0) record and then prematurely closing the transport connection. CVE-2026-19033 describes a similar scenario for secondary zones with TSIG restrictions, where named might serve data before a valid TSIG signature arrives, potentially allowing unauthorized zone contents. CVE-2026-19662 involves inducing a resolver to send multiple queries for a DNSSEC-signed zone, which, if met with a particular sequence of crafted answers, can cause an abort.
ISC has released BIND 9.20.29 and 9.21.26 to address these flaws. According to The Hacker News and SecurityWeek, ISC is not aware of any of these fourteen vulnerabilities being actively exploited in the wild. Users are advised to update to the patched versions to mitigate the risks associated with these DoS vulnerabilities.
The batch of vulnerabilities underscores the complexity of DNSSEC and the potential for subtle misconfigurations or malformed data to lead to significant availability issues in critical DNS infrastructure. Maintaining up-to-date BIND software is crucial for organizations relying on it for DNS resolution services. The coordinated disclosure by ISC highlights the ongoing efforts to secure the DNS ecosystem.