AI analysis
ISC BIND 9 contains a NULL pointer dereference (CWE-476) that causes the `named` daemon to abort when it receives a DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record followed by a premature close of the transport connection. An unauthenticated remote attacker can trigger the crash repeatedly, achieving a denial of service with no confidentiality or integrity impact (CVSS availability-only). Only deployments running affected 9.20.x, 9.21.x, or 9.20.x-S1 versions with DoH listeners configured are exposed; servers without DoH endpoints enabled are not vulnerable. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.
What to do: Upgrade to the patched releases published by ISC for the 9.20, 9.21, and 9.20-S1 branches (see the corresponding ISC advisory for exact fixed version numbers). As an interim mitigation, disable or remove DNS-over-HTTPS (http) listeners in named.conf, or restrict DoH endpoints at the firewall/ACL level to trusted clients. Check whether your named.conf defines http endpoints and whether port 443 DoH service is internet-facing; if not, your exposure is limited.
Affected
| Internet Systems Consortium (ISC) BIND 9 | 9.20.0 through 9.20.27 |
| Internet Systems Consortium (ISC) BIND 9 | 9.21.0 through 9.21.25 |
| Internet Systems Consortium (ISC) BIND 9 (Stable Subscription Edition) | 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
largelikely tens of thousands of internet-exposed `named` instances (BIND is the most widely deployed DNS server software, but only the subset running 9.20/9.21… — Internet-wide scans have long shown hundreds of thousands of publicly reachable BIND servers, and 9.20 is ISC's current stable branch; however, DoH support must be explicitly configured via http listeners, which shrinks the truly…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.