The **Internet Systems Consortium (ISC)** has rolled out **BIND 9.20.29** and **9.21.26**, crucial updates designed to patch fourteen security vulnerabilities within its ubiquitous open-source DNS server software, **BIND 9**. The disclosure, made on September 16, highlights a series of critical flaws, though **ISC** has stated it is not aware of any active exploitation. One particularly concerning vulnerability, affecting any **BIND** server that answers DNS-over-HTTPS (DoH), allows an unauthenticated sender to crash the `named` server process with a single request. This occurs if the sender transmits an invalid **SIG(0)** signature and then closes the connection before `named` completes signature verification.  ### Patch Releases and Unsupported Versions **ISC's** release notes detail the following fixes: * **BIND 9.20.29** (current stable branch): Addresses all fourteen vulnerabilities. * **BIND 9.21.26** (development branch): Fixes thirteen vulnerabilities, with **CVE-2026-19662** not affecting this branch. * **BIND 9.20.29-S1** (Supported Preview Edition for customers): Fixes all fourteen vulnerabilities. Crucially, **ISC** has not provided workarounds for any of these flaws. Twelve of the fourteen vulnerabilities also impact the older **9.18** branch, including its final release, **9.18.50**. Support for **BIND 9.18** ended in June, and **ISC** has not issued a fix for this branch, reiterating its earlier advice from May for **9.18** users to migrate to **9.20** as soon as possible. End-of-life versions are presumed vulnerable to new **CVEs**. Operating system packages, such as **Debian 12** (which ships with **BIND 9.18.49**), may lag in adopting these fixes. As of September 17, **Debian's** security tracker had not yet listed any of the fourteen new vulnerabilities. ### Attack Vectors and High-Severity Flaws Two of the newly disclosed flaws can be triggered by a single request without the need for an attacker-controlled DNS server, affecting only the **9.20** and **9.21** branches: * **CVE-2026-77692**: The DoH crash vulnerability, rated High severity. * **CVE-2026-76163**: Allows a **TKEY** query to crash `named` if the server's `named.conf` lacks a global `options` block, also rated High severity. The remaining vulnerabilities generally require a recursive resolver to receive crafted data from an attacker-controlled server. Several of these can lead to resolver crashes, even on default configurations or specific setups like `dns64` with `break-dnssec yes`. Four other flaws lead to CPU or memory exhaustion rather than outright crashes. Notably, **CVE-2026-81563** and **CVE-2026-81736** exploit cached **SVCB/HTTPS** alias records. Seven of the fourteen vulnerabilities are rated High severity (CVSS 3.1 score of 7.5), including the aforementioned crashes and the **SVCB/HTTPS** exhaustion issues. The other seven are rated Medium (CVSS 3.1 scores 5.3 to 6.5). ### DNS Data Integrity and Cache Poisoning Four of the medium-severity flaws concern the integrity of DNS data, impacting what a server serves or what a resolver accepts. Each has specific conditions regarding attacker placement or control: * **CVE-2026-19941**: A validating resolver can accept a forged **NXDOMAIN** answer, leading to cache poisoning. An attacker controlling a signed zone (on-path or as a forwarder) can make an unrelated signed **NSEC** record appear as proof against a wildcard. * **CVE-2026-77119**: Similar cache poisoning, where a signed **NSEC3** record from an unrelated sibling zone can be accepted as proof that a delegation is unsigned, allowing forged unsigned answers. * **CVE-2026-19033**: Affects secondary servers using **TSIG**-signed incremental zone transfers (IXFR). `named` could serve new zone data before the final signature arrived and wouldn't roll back if the signature was missing, potentially allowing unauthorized zone content to be served. The fix now requires **TSIG** on every message of an incoming transfer. * **CVE-2026-78301**: An attacker who can load a malformed zone onto an authoritative server (e.g., via zone transfer) can cause the server to treat an **NS** or **DNAME** node above its origin as a zone cut. This can lead to out-of-zone delegations and potentially allow the server to cache attacker-supplied records for names outside the zone. ### The Fourteen Flaws at a Glance | CVE | ISC Score | Effect | Condition | Affected (open source) | Fixed in | | :------------- | :-------- | :-------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------ | :---------------- | | **CVE-2026-77692** | 7.5 High | Crash of named | Server answers DoH. Invalid SIG(0) request, connection closed early | 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-76163** | 7.5 High | Crash of named | TKEY query. named.conf has no global options block | 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-19667** | 7.5 High | Crash of resolver | Crafted negative answer of exactly 65536 bytes from an attacker-run server. Default configuration | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-19666** | 7.5 High | Crash of resolver | dns64 with break-dnssec yes. Malformed answer served from cache | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-80274** | 7.5 High | Crash of resolver, SERVFAIL, or wrong denial record served | Validating resolver. Wildcard answer with both NSEC3 and unsigned NSEC at the same name | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-19662** | 5.9 Medium| Crash of resolver | Attacker-run signed zone. Specific answer order and timing | 9.11.0-9.18.50, 9.20.0-9.20.27 | 9.20.29 | | **CVE-2026-81563** | 7.5 High | Cache grows past its limit until resolution fails | Resolver follows an SVCB/HTTPS alias with more than 13 target records, repeatedly | 9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-81736** | 7.5 High | CPU exhaustion on resolver | Cached SVCB/HTTPS alias tree. Client allowed recursion plus attacker-run zone | 9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-19668** | 5.3 Medium| CPU exhaustion on validating resolver | Zone with many key tags and no valid match. ISC says default record limits reduce exposure | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-75029** | 5.3 Medium| Memory use beyond configured limits | Response repeats the same SOA, CNAME or DNAME record many times | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 | | **CVE-2026-19941** | 5.9 Medium| Forged NXDOMAIN accepted, which ISC calls cache poisoning | Validating resolver. Attacker controlling a signed zone at the same or an upstream level, on-path or as a forwarder | 9.11.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25 | 9.20.29, 9.21.26 |