BIND 9 Update Patches 14 Critical Security Flaws

The Internet Systems Consortium (ISC) has released version 9.20.29 and 9.21.26 of BIND 9, the open-source software that powers a significant portion of the internet's Domain Name System infrastructure. These updates address fourteen distinct security flaws, the most critical of which allows an unauthenticated attacker to crash the server process with a single malformed request. According to The Hacker News, this specific vulnerability affects any BIND server configured to handle DNS-over-HTTPS traffic, posing an immediate stability risk to organizations relying on this modern encryption protocol.

ISC confirms that it is not aware of any of these fourteen flaws being actively exploited in the wild. However, the organization emphasizes that the lack of workarounds means patching is the only effective defense. The release notes indicate that the stable branch release, 9.20.29, fixes all fourteen issues, while the development branch release, 9.21.26, addresses thirteen of them. Users of the older 9.18 branch are left without a fix, as ISC ended support for that line in June and advises immediate migration to the 9.20 series.

Unauthenticated Attackers Can Crash Servers

Two of the fourteen vulnerabilities can be triggered by a direct request without the attacker needing to control a separate DNS server. The primary concern is CVE-2026-77692, which targets the DNS-over-HTTPS implementation. An attacker can send a request containing an invalid signature and then abruptly close the connection before the server, named, finishes verifying it. This timing issue causes the server process to crash, effectively denying service to legitimate users. A second vulnerability, CVE-2026-76163, allows a similar crash via a specific query type if the server configuration lacks a global options block.

The remaining crash vulnerabilities require a recursive resolver to receive crafted data from a server controlled by the attacker. These scenarios exploit default configurations or specific features like dns64. For example, CVE-2026-19667 allows a single crafted response to crash a resolver on default settings. Other flaws, such as CVE-2026-80274, exploit wildcard answers that carry conflicting proof types, leading to instability. These attacks do not require complex infrastructure, making them attractive to low-sophistication threat actors seeking to disrupt network operations.

Resource Exhaustion and Data Integrity Risks

Beyond crashes, several flaws allow attackers to exhaust a resolver's CPU or memory resources. Two of these, CVE-2026-81563 and CVE-2026-81736, exploit cached SVCB/HTTPS alias records to degrade performance. ISC rates seven of the fourteen flaws as High severity, with a CVSS score of 7.5, primarily due to their ease of exploitation and impact on availability. The other seven are rated Medium, ranging from 5.3 to 6.5, often because they require more specific preconditions or attacker positioning.

Four additional flaws concern the integrity of DNS data rather than availability. These vulnerabilities allow a validating resolver to accept incorrect DNSSEC proofs, effectively enabling cache poisoning. For instance, CVE-2026-19941 allows a signed record from an unrelated zone to falsely prove that a wildcard does not exist, leading to forged negative answers. Similarly, CVE-2026-77119 permits an attacker to forge unsigned answers for delegated names. These integrity issues are significant because they can silently redirect users to malicious servers while maintaining the appearance of valid, encrypted DNS responses.

Legacy Versions Remain Vulnerable

A significant trade-off for organizations is the abandonment of the 9.18 branch. Twelve of the fourteen flaws affect this older version, but ISC has released no patches for it, citing its end-of-life status. The vulnerability matrix explicitly states that end-of-life versions should be assumed vulnerable to new CVEs. While operating system packages, such as those in Debian 12, may lag in updating, the core software no longer receives security fixes for this branch. This forces administrators to upgrade to 9.20 immediately, a task that can be complex for large, distributed DNS infrastructures.

The absence of workarounds for any of the fourteen flaws underscores the urgency of the update. For those running the Supported Preview Edition, release 9.20.29-S1 includes all fixes. However, for the vast majority of users, the path to security is clear but demanding. The combination of unauthenticated crash vectors and data integrity risks means that unpatched servers are not just slow or unstable, but potentially compromised. The incident highlights the critical role of BIND 9 in internet stability and the heavy burden on administrators to keep pace with rapid security disclosures.