ISC Patches 14 Vulnerabilities in BIND 9 Security Update

CVE-2026-19666 is a use-after-free flaw (CWE-416) in the DNS64 processing path of ISC's BIND 9 DNS server. On a recursive resolver ('named') configured with dns64, receiving an applicable answer from an authoritative server that is malformed in a specific way causes the named process to exit unexpectedly. An unauthenticated remote attacker can therefore crash the resolver, achieving a denial of service with high availability impact but no confidentiality or integrity impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N). Only operators running the listed BIND 9 versions with dns64 enabled are affected; resolvers without dns64 configured are not impacted by this flaw. There is no known public proof-of-concept and the vulnerability is not on the CISA KEV list, though it was disclosed as one of fourteen BIND 9 issues by ISC.

Do: Upgrade affected BIND 9 resolvers to a patched release beyond the listed version ranges as soon as ISC's updated builds are available, prioritizing recursively-serving resolvers with dns64 configured. As an interim mitigation, remove or comment out the dns64 block in named.conf if IPv6 translation is not required, and restrict recursion to trusted client networks. Verify exposure by checking named.conf (or included files) for dns64 directives.

CVE-2026-19667 is a numeric type conversion error (CWE-197) in ISC BIND's `named` resolver: when an authoritative server returns a negative answer (e.g., NXDOMAIN/NODATA) that is exactly 65536 bytes long, `named` mis-handles the size and stores a 0-byte negative cache entry. When that cache entry is subsequently read to answer a client query, the `named` process aborts, taking down the resolver's DNS service. An attacker who controls an authoritative server for any domain the resolver will look up (e.g., a domain they own, with lookups induced via links or other references) can crash an unpatched recursive resolver remotely without credentials. Organizations and providers running affected BIND 9 versions as caching/recursive resolvers are affected; purely authoritative servers are not the relevant exposure. As of publication there is no known public proof-of-concept, the flaw is not listed in CISA KEV, and no exploitation has been reported.

Do: Upgrade caching/recursive BIND resolvers to a patched release beyond the affected ranges listed in ISC's advisory (i.e., newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S1 preview builds), and verify running versions with `named -v`. Restrict recursion to trusted client networks to reduce who can be leveraged to trigger lookups, and monitor resolvers for unexpected `named` aborts/restarts. Authoritative-only servers that do not perform recursion and negative caching are not meaningfully exposed.

ISC BIND 9, the widely used open-source DNS server, contains a remotely triggerable denial-of-service flaw (CWE-617, reachable assertion). If the server's named.conf file lacks a global "options" block, an unauthenticated attacker can send a DNS query of QTYPE TKEY that causes an assertion failure and unexpected exit of the named daemon. The attacker gains only availability impact — the DNS server can be crashed and kept down by repeated queries — with no confidentiality or confidentiality/integrity effect (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Affected deployments are BIND 9.20.0 through 9.20.27, the 9.21.0 through 9.21.25 development branch, and 9.20.9-S1 through 9.20.27-S1, but only where the configuration omits a global options block. No public proof-of-concept is known, it is not in CISA KEV, and it is one of fourteen BIND 9 vulnerabilities ISC has disclosed.

Do: Upgrade BIND 9 to a release newer than the affected boundaries (9.20.27, 9.21.25, and 9.20.27-S1) per ISC's advisory for this CVE. As an interim mitigation, ensure named.conf contains a global "options" block, since the crash is only reachable when it is absent. Admins should also review ISC's advisory covering the fourteen BIND 9 vulnerabilities disclosed together and patch accordingly.

ISC BIND 9 contains a NULL pointer dereference (CWE-476) that causes the `named` daemon to abort when it receives a DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record followed by a premature close of the transport connection. An unauthenticated remote attacker can trigger the crash repeatedly, achieving a denial of service with no confidentiality or integrity impact (CVSS availability-only). Only deployments running affected 9.20.x, 9.21.x, or 9.20.x-S1 versions with DoH listeners configured are exposed; servers without DoH endpoints enabled are not vulnerable. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

Do: Upgrade to the patched releases published by ISC for the 9.20, 9.21, and 9.20-S1 branches (see the corresponding ISC advisory for exact fixed version numbers). As an interim mitigation, disable or remove DNS-over-HTTPS (http) listeners in named.conf, or restrict DoH endpoints at the firewall/ACL level to trusted clients. Check whether your named.conf defines http endpoints and whether port 443 DoH service is internet-facing; if not, your exposure is limited.

CVE-2026-80274 is a remotely triggerable denial-of-service (unexpected program exit, CWE-617) in ISC BIND 9 recursive resolvers when processing certain DNSSEC responses. It is triggered without authentication or user interaction when a resolver queries a DNSSEC-signed authoritative zone and receives a valid wildcard answer with a signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. A successful trigger crashes the named daemon, denying DNS service to all clients that depend on that resolver until it is restarted. Any operator running an affected BIND 9 resolver that performs DNSSEC validation is exposed (authoritative-only servers are not the crash target). No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; the flaw was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.

Do: Upgrade affected resolvers to the first fixed release per ISC's advisory for CVE-2026-80274 (any release after 9.18.50, 9.20.27, 9.21.25, and the corresponding 9.18.50-S1 / 9.20.27-S1 preview builds). As interim mitigation, restrict recursion to trusted clients and, if operationally acceptable, disable DNSSEC validation on exposed resolvers until patching. Since ISC disclosed fourteen BIND 9 vulnerabilities at once, inventory all resolver instances and patch the full set together.

A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade resolvers to the patched BIND release on your branch per ISC's CVE-2026-81563 advisory — i.e., any release newer than 9.18.50, 9.20.27, 9.21.25, 9.18.50-S1, or 9.20.27-S1 as applicable. Until patched, restrict recursion to trusted clients (allow-recursion ACLs) so internet hosts cannot drive lookups, and monitor resolver memory, restarting services that show abnormal growth. Treat unexplained loss of recursive resolution ability as a possible sign of exploitation.

ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

Do: Upgrade each deployed branch to the patched release outside the listed ranges (i.e., later than 9.18.50 / 9.20.27 / 9.21.25 or the corresponding -S1 builds) as published in ISC's advisory. Until patched, verify your version with 'named -v', ensure the resolver is not open to the internet by restricting recursion to trusted clients, monitor named CPU utilization for anomalies, and flush the cache if a suspicious SVCB/HTTPS AliasMode tree is suspected.