Remote DoS in ISC BIND 9 resolvers via crafted DNSSEC wildcard NSEC3/NSEC response
AI analysis
CVE-2026-80274 is a remotely triggerable denial-of-service (unexpected program exit, CWE-617) in ISC BIND 9 recursive resolvers when processing certain DNSSEC responses. It is triggered without authentication or user interaction when a resolver queries a DNSSEC-signed authoritative zone and receives a valid wildcard answer with a signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. A successful trigger crashes the named daemon, denying DNS service to all clients that depend on that resolver until it is restarted. Any operator running an affected BIND 9 resolver that performs DNSSEC validation is exposed (authoritative-only servers are not the crash target). No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; the flaw was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.
What to do: Upgrade affected resolvers to the first fixed release per ISC's advisory for CVE-2026-80274 (any release after 9.18.50, 9.20.27, 9.21.25, and the corresponding 9.18.50-S1 / 9.20.27-S1 preview builds). As interim mitigation, restrict recursion to trusted clients and, if operationally acceptable, disable DNSSEC validation on exposed resolvers until patching. Since ISC disclosed fourteen BIND 9 vulnerabilities at once, inventory all resolver instances and patch the full set together.
Affected
| ISC BIND 9 (open source, recursive resolver) | 9.11.0 through 9.18.50; 9.20.0 through 9.20.27; 9.21.0 through 9.21.25 |
| ISC BIND 9 Supported Preview Edition (-S) | 9.11.3-S1 through 9.18.50-S1; 9.20.9-S1 through 9.20.27-S1 |
Estimated exposure
masslikely 100,000+ BIND resolver deployments potentially affected (order of magnitude 10^5–10^6 total BIND installations, of which validating recursive resolvers… — BIND is one of the most widely deployed DNS server packages and internet-wide scans routinely identify hundreds of thousands of BIND instances, but only recursive resolvers performing DNSSEC validation within the listed version ranges are…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.