BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
ISC released BIND 9.20.29 and 9.21.26 fixing 14 flaws, including an unauthenticated DoH crash (CVE-2026-77692) and DNSSEC cache poisoning issues; no exploitation reported.
ISC patched fourteen flaws in BIND 9 on September 16, releasing 9.20.29 (stable) and 9.21.26 (development). CVE-2026-77692 (CVSS 7.5) lets an unauthenticated sender crash any server answering DNS-over-HTTPS with a single invalid SIG(0) request, and CVE-2026-76163 crashes named via TKEY queries; other High-severity flaws crash resolvers on default configurations or exhaust CPU and memory. Two DNSSEC flaws, CVE-2026-19941 and CVE-2026-77119, allow cache poisoning with forged denial or unsigned answers. ISC lists no workarounds, says none of the flaws are known to be exploited, and warns that the EOL 9.18 branch (through 9.18.50) will receive no fixes for twelve of them.
- CVE-2026-77692 (CVSS 7.5): unauthenticated single request crashes any BIND server answering DNS-over-HTTPS.
- Seven flaws rated High (7.5); four Medium flaws enable DNSSEC cache poisoning or unauthorized zone data serving.
- Twelve flaws also affect the EOL 9.18 branch through 9.18.50, which receives no fixes.
- No workarounds; ISC says it is unaware of any active exploitation of the fourteen flaws.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19666 | Use-After-Free DoS in ISC BIND 9 DNS64 Resolvers | 7.5 group max | — | ||
CVE-2026-77692+2 related CVEs | Unauthenticated DoS in ISC BIND 9 via crafted SIG(0) DNS-over-HTTPS requests | 7.5 group max | — |
From the original article
7 min read at thehackernews.com
The Internet Systems Consortium (ISC) has released BIND 9. 20. 29 and 9.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.