CVE-2026-76163

ISC BIND 9, the widely used open-source DNS server, contains a remotely triggerable denial-of-service flaw (CWE-617, reachable assertion). If the server's named.conf file lacks a global "options" block, an unauthenticated attacker can send a DNS query of QTYPE TKEY that causes an assertion failure and unexpected exit of the named daemon. The attacker gains only availability impact — the DNS server can be crashed and kept down by repeated queries — with no confidentiality or confidentiality/integrity effect (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Affected deployments are BIND 9.20.0 through 9.20.27, the 9.21.0 through 9.21.25 development branch, and 9.20.9-S1 through 9.20.27-S1, but only where the configuration omits a global options block. No public proof-of-concept is known, it is not in CISA KEV, and it is one of fourteen BIND 9 vulnerabilities ISC has disclosed.

What to do: Upgrade BIND 9 to a release newer than the affected boundaries (9.20.27, 9.21.25, and 9.20.27-S1) per ISC's advisory for this CVE. As an interim mitigation, ensure named.conf contains a global "options" block, since the crash is only reachable when it is absent. Admins should also review ISC's advisory covering the fourteen BIND 9 vulnerabilities disclosed together and patch accordingly.