ISC Patches 14 Vulnerabilities in BIND 9, Addressing Denial-of-Service Risks
Internet Systems Consortium (ISC) has released security updates for BIND 9, resolving 14 vulnerabilities, seven of which are high-severity and could lead to denial-of-service conditions.
Internet Systems Consortium (ISC) has issued critical security updates for BIND 9, the ubiquitous open-source Domain Name System (DNS) server software. The patches address a total of 14 vulnerabilities, with seven classified as high-severity, posing significant risks of denial-of-service (DoS) conditions.
These high-severity flaws, tracked under CVE identifiers including CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667, and CVE-2026-81736, can be exploited by attackers to cause unexpected program termination, exhaust system memory, crash the named process, or generally lead to resource exhaustion.
The vulnerabilities can be triggered through various means, including the use of mismatched NOQNAME proof, malformed QTYPE TKEY queries, specially crafted DNS-over-HTTPS (DoH) requests, and negative DNS answers exceeding 65,536 bytes. The specific mechanisms highlight the intricate ways DNS protocol elements can be abused when not handled with sufficient validation.
One particularly concerning vulnerability, CVE-2026-77692, allows for remote exploitation without authentication. An attacker can trigger a crash of the named process by sending a single, crafted DNS-over-HTTPS request containing a cryptographically invalid SIG(0) record, followed by prematurely closing the transport connection. This specific flaw underscores the importance of robust input validation and connection handling in network services.
In addition to the high-severity issues, the update also resolves seven medium-severity vulnerabilities. These flaws could potentially lead to DNS cache poisoning, increased memory consumption within the negative cache, CPU exhaustion, packet loss, or the unauthorized addition of attacker-supplied data into DNS zones, all contributing to potential DoS scenarios or data integrity issues.
ISC has released BIND versions 9.21.26 and 9.20.29 to address all identified security defects. The organization stated that it is not aware of any of these vulnerabilities being actively exploited in the wild. However, given the critical nature of DNS infrastructure, prompt updating of all BIND deployments is strongly recommended to mitigate potential risks.
Users and administrators are advised to consult the official BIND security advisories page and the BIND 9 release notes for detailed information on the vulnerabilities and the patching process. Maintaining up-to-date DNS server software is crucial for network stability and security, as compromised DNS services can have far-reaching consequences for internet accessibility and security.
This update provides specific details on fourteen vulnerabilities patched in BIND 9, including CVE-2026-77692, which allows unauthenticated attackers to crash servers processing DNS-over-HTTPS (DoH) requests with a malformed query. The advisory also details other crash and data integrity flaws, noting that none are currently known to be exploited in the wild.
This new article provides specific details on 14 vulnerabilities affecting BIND 9, including several that enable DNS cache poisoning (CVE-2025-40778, CVE-2025-40780) and others that lead to remote denial-of-service conditions (CVE-2026-5947, CVE-2026-3593). It also details the specific fixes implemented by ISC, such as replacing the pseudo-random number generator and modifying how DNAME records are handled, and outlines additional resource-exhaustion protections.