ISC Patches 14 Vulnerabilities in BIND 9 Security Update
ISC patched 14 BIND 9 vulnerabilities, seven high-severity, all enabling denial-of-service conditions, with no exploitation observed so far.
Internet Systems Consortium released BIND 9.21.26 and 9.20.29 fixing 14 flaws, seven rated high severity, that cause DoS via mismatched NOQNAME proofs, QTYPE TKEY queries, malformed authoritative answers, SVCB/HTTPS AliasMode records, crafted DNS-over-HTTPS requests, and oversized negative answers. CVE-2026-77692 lets an unauthenticated attacker crash named with a single crafted DoH SIG(0) request followed by premature connection closure. Medium-severity issues include cache poisoning and attacker-supplied data added to a zone. ISC says it is not aware of any of the bugs being exploited in the wild.
- 14 vulnerabilities fixed in BIND 9.21.26 and 9.20.29; seven rated high severity
- CVE-2026-77692: a single unauthenticated DoH SIG(0) request crashes named
- Medium flaws enable cache poisoning and attacker-controlled zone data
- ISC urges prompt updates though no in-the-wild exploitation is known
- CVEs
- CVE-2026-80274CVE-2026-76163CVE-2026-19666CVE-2026-81563CVE-2026-77692CVE-2026-19667CVE-2026-81736
- Vendors
- Internet Systems Consortium
- Products
- BIND 9
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19666+4 related CVEs | Use-After-Free DoS in ISC BIND 9 DNS64 Resolvers | 7.5 | — | ||
CVE-2026-77692+1 related CVE | Unauthenticated DoS in ISC BIND 9 via crafted SIG(0) DNS-over-HTTPS requests | 7.5 | — |
From the original article
1 min read at securityweek.com
Attackers could exploit the flaws to increase resource usage, trigger an unexpected program exit, or terminate the named process. The post ISC Patches 14 Vulnerabilities in BIND 9 Security Update appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.