BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

In ISC BIND 9, a secondary server that restricts zone transfers with TSIG may begin serving data from an incoming multi-message TCP IXFR before the final message carrying the TSIG signature arrives, and it never rolls back to the pre-transfer state if that signature never arrives (CWE-349, acceptance of extraneous untrusted data). An attacker who does not possess a valid TSIG key but can impersonate the zone's primary on the transfer path (e.g., via a spoofed or man-in-the-middle transfer session) can send unauthorized zone contents, which the secondary then serves to clients. The impact is loss of DNS data integrity with limited availability impact and no confidentiality impact (CVSS 6.5, network vector with high attack complexity). Any BIND 9 deployment in the affected version ranges configured as a secondary zone with TSIG-restricted transfers is affected, and the transfer must be a multi-message TCP IXFR as described by RFC 8945. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; ISC disclosed this flaw as one of fourteen BIND 9 vulnerabilities.

Do: Upgrade BIND 9 to the fixed releases from ISC's advisory, i.e., versions later than 9.18.50, 9.20.27, or 9.21.25 (or the matching -S1 builds) depending on the branch in use. As interim mitigations on secondaries, disable incremental transfers to primaries (request-ixfr no; in named.conf, since the flaw requires a multi-message TCP IXFR) and layer source-address restrictions (allow-notify / primaries ACLs) on top of TSIG so only the genuine primary can initiate updates. Audit named.conf for secondary zones whose transfer protection relies solely on TSIG keys.

CVE-2026-19662 is a use-after-free flaw (CWE-416) in ISC BIND 9's named resolver that can cause the daemon to abort, resulting in a denial of service. An attacker must operate an authoritative server hosting a DNSSEC-signed zone and induce the victim resolver to send multiple queries to it; the crash only occurs if the attacker's crafted answers arrive in a particular sequence, order, and timing, making the attack reliable but non-trivial (CVSS attack complexity is High). A successful attack yields no data theft or tampering — only a crash of the resolver process (availability impact rated High). Any organization running an affected BIND 9 version as a recursive resolver is potentially exposed, since the resolver can be steered to the attacker's authoritative server via queries from its clients. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is reported; it was disclosed by ISC as part of a batch of fourteen BIND 9 vulnerabilities.

Do: Upgrade all recursive BIND 9 resolvers past the affected ranges — i.e., to the first maintenance releases of the 9.18, 9.20, and Supported Preview (S1) branches issued after 9.18.50/9.20.27 and the matching -S1 builds, per ISC's advisory covering these fourteen CVEs. Until patched, restrict recursion to trusted client networks only, and monitor named logs for unexplained resolver aborts/restarts, which would indicate attempted triggering. Authoritative-only servers that do not perform recursion are not meaningfully exposed to this attack path.

CVE-2026-19666 is a use-after-free flaw (CWE-416) in the DNS64 processing path of ISC's BIND 9 DNS server. On a recursive resolver ('named') configured with dns64, receiving an applicable answer from an authoritative server that is malformed in a specific way causes the named process to exit unexpectedly. An unauthenticated remote attacker can therefore crash the resolver, achieving a denial of service with high availability impact but no confidentiality or integrity impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N). Only operators running the listed BIND 9 versions with dns64 enabled are affected; resolvers without dns64 configured are not impacted by this flaw. There is no known public proof-of-concept and the vulnerability is not on the CISA KEV list, though it was disclosed as one of fourteen BIND 9 issues by ISC.

Do: Upgrade affected BIND 9 resolvers to a patched release beyond the listed version ranges as soon as ISC's updated builds are available, prioritizing recursively-serving resolvers with dns64 configured. As an interim mitigation, remove or comment out the dns64 block in named.conf if IPv6 translation is not required, and restrict recursion to trusted client networks. Verify exposure by checking named.conf (or included files) for dns64 directives.

CVE-2026-19667 is a numeric type conversion error (CWE-197) in ISC BIND's `named` resolver: when an authoritative server returns a negative answer (e.g., NXDOMAIN/NODATA) that is exactly 65536 bytes long, `named` mis-handles the size and stores a 0-byte negative cache entry. When that cache entry is subsequently read to answer a client query, the `named` process aborts, taking down the resolver's DNS service. An attacker who controls an authoritative server for any domain the resolver will look up (e.g., a domain they own, with lookups induced via links or other references) can crash an unpatched recursive resolver remotely without credentials. Organizations and providers running affected BIND 9 versions as caching/recursive resolvers are affected; purely authoritative servers are not the relevant exposure. As of publication there is no known public proof-of-concept, the flaw is not listed in CISA KEV, and no exploitation has been reported.

Do: Upgrade caching/recursive BIND resolvers to a patched release beyond the affected ranges listed in ISC's advisory (i.e., newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S1 preview builds), and verify running versions with `named -v`. Restrict recursion to trusted client networks to reduce who can be leveraged to trigger lookups, and monitor resolvers for unexpected `named` aborts/restarts. Authoritative-only servers that do not perform recursion and negative caching are not meaningfully exposed.

This is a DNSSEC validation flaw (CWE-345) in BIND 9's `named` resolver, which may accept an inapplicable NSEC record as valid proof that no wildcard record exists for a zone name. An attacker positioned at the same or an upstream level of the victim's zone name — for example, an operator of a sibling or parent zone able to present the malformed NSEC proof — can trigger the flaw in a validating resolver. The result is that the victim's wildcard record is treated as nonexistent, so the attacker can spoof or suppress answers in a way that still passes DNSSEC validation, yielding a high integrity impact (no confidentiality or availability impact per the CVSS vector). Only operators running affected BIND 9 versions as validating resolvers, particularly zones that rely on wildcard records, are affected. The issue was disclosed by ISC as one of fourteen BIND 9 vulnerabilities; it is not in CISA's KEV catalog and no public proof-of-concept or known exploitation exists.

Do: Upgrade all validating `named` resolvers to the patched BIND 9 releases published by ISC for each affected branch (i.e., releases newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S builds), per ISC's advisory for CVE-2026-19941. Administrators of DNSSEC-signed zones that depend on wildcard records should investigate client reports of unexpected NXDOMAIN/nodata answers. Restricting recursion to trusted clients is a useful defense-in-depth measure, but patching is the only complete fix.

ISC BIND 9, the widely used open-source DNS server, contains a remotely triggerable denial-of-service flaw (CWE-617, reachable assertion). If the server's named.conf file lacks a global "options" block, an unauthenticated attacker can send a DNS query of QTYPE TKEY that causes an assertion failure and unexpected exit of the named daemon. The attacker gains only availability impact — the DNS server can be crashed and kept down by repeated queries — with no confidentiality or confidentiality/integrity effect (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Affected deployments are BIND 9.20.0 through 9.20.27, the 9.21.0 through 9.21.25 development branch, and 9.20.9-S1 through 9.20.27-S1, but only where the configuration omits a global options block. No public proof-of-concept is known, it is not in CISA KEV, and it is one of fourteen BIND 9 vulnerabilities ISC has disclosed.

Do: Upgrade BIND 9 to a release newer than the affected boundaries (9.20.27, 9.21.25, and 9.20.27-S1) per ISC's advisory for this CVE. As an interim mitigation, ensure named.conf contains a global "options" block, since the crash is only reachable when it is absent. Admins should also review ISC's advisory covering the fourteen BIND 9 vulnerabilities disclosed together and patch accordingly.

BIND 9's DNSSEC validator can mistakenly accept a validly signed NSEC3 record from an unrelated sibling zone as proof that a delegation is insecure. An attacker who can inject a crafted response into a resolver's validation process (e.g., an on-path attacker or in a cache-poisoning race) can downgrade a securely signed delegation to insecure, causing a forged, unsigned answer to be accepted and cached. The impact is DNS spoofing of validating resolvers: integrity loss only, with no confidentiality or availability effect (CVSS 5.9, CWE-346 origin validation error). Any operator running an affected BIND 9 release with DNSSEC validation enabled is affected. No public proof of concept and no known in-the-wild exploitation have been reported.

Do: Upgrade validating resolvers to the patched BIND 9 release that fixes CVE-2026-77119 as soon as ISC publishes it (part of a 14-CVE BIND 9 disclosure; monitor ISC advisories for fixed build numbers). Until patched, restrict recursion to trusted clients and review which resolvers in your estate run affected versions with DNSSEC validation enabled. Not listed in CISA KEV and no PoC is public, but prioritize because successful abuse silently serves forged DNS records.

ISC BIND 9 contains a NULL pointer dereference (CWE-476) that causes the `named` daemon to abort when it receives a DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record followed by a premature close of the transport connection. An unauthenticated remote attacker can trigger the crash repeatedly, achieving a denial of service with no confidentiality or integrity impact (CVSS availability-only). Only deployments running affected 9.20.x, 9.21.x, or 9.20.x-S1 versions with DoH listeners configured are exposed; servers without DoH endpoints enabled are not vulnerable. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

Do: Upgrade to the patched releases published by ISC for the 9.20, 9.21, and 9.20-S1 branches (see the corresponding ISC advisory for exact fixed version numbers). As an interim mitigation, disable or remove DNS-over-HTTPS (http) listeners in named.conf, or restrict DoH endpoints at the firewall/ACL level to trusted clients. Check whether your named.conf defines http endpoints and whether port 443 DoH service is internet-facing; if not, your exposure is limited.

ISC BIND 9's named daemon incorrectly treats an NS or DNAME node placed above a zone's origin as a zone cut, so an attacker who can insert a malformed zone into an authoritative server (for example, via zone transfer or by loading zones on a shared DNS service) can make queries within that configured zone lose authoritative status and return an out-of-zone delegation. On servers that also provide recursion, BIND then follows this locally sourced, attacker-influenced cut and caches attacker-supplied data, poisoning answers for names outside the configured zone; the condition persists for as long as the malformed zone remains in the zone database. Any deployment running an affected BIND 9 version that combines authoritative service for attacker-influenceable zones with recursion, or that accepts zone transfers from less-trusted sources, is exposed. ISC assigned it CVSS 5.8 (medium) with high attack complexity and high privileges required, reflecting these preconditions. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.

Do: Upgrade each affected BIND 9 branch to the first ISC-patched release after the last affected version listed for that branch (including the -S1 subscription branches). Meanwhile, restrict AXFR/IXFR zone transfers to trusted peers with TSIG-signed allow-transfer ACLs, run authoritative and recursive service on separate named instances or disable recursion on authoritative-only servers, and audit zone files and transferred zones for NS or DNAME records at or above the zone origin, removing any malformed zone and flushing the cache if found.

CVE-2026-80274 is a remotely triggerable denial-of-service (unexpected program exit, CWE-617) in ISC BIND 9 recursive resolvers when processing certain DNSSEC responses. It is triggered without authentication or user interaction when a resolver queries a DNSSEC-signed authoritative zone and receives a valid wildcard answer with a signed NSEC3 proof, followed by an unsigned NSEC record at the same owner name. A successful trigger crashes the named daemon, denying DNS service to all clients that depend on that resolver until it is restarted. Any operator running an affected BIND 9 resolver that performs DNSSEC validation is exposed (authoritative-only servers are not the crash target). No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; the flaw was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.

Do: Upgrade affected resolvers to the first fixed release per ISC's advisory for CVE-2026-80274 (any release after 9.18.50, 9.20.27, 9.21.25, and the corresponding 9.18.50-S1 / 9.20.27-S1 preview builds). As interim mitigation, restrict recursion to trusted clients and, if operationally acceptable, disable DNSSEC validation on exposed resolvers until patching. Since ISC disclosed fourteen BIND 9 vulnerabilities at once, inventory all resolver instances and patch the full set together.

A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade resolvers to the patched BIND release on your branch per ISC's CVE-2026-81563 advisory — i.e., any release newer than 9.18.50, 9.20.27, 9.21.25, 9.18.50-S1, or 9.20.27-S1 as applicable. Until patched, restrict recursion to trusted clients (allow-recursion ACLs) so internet hosts cannot drive lookups, and monitor resolver memory, restarting services that show abnormal growth. Treat unexplained loss of recursive resolution ability as a possible sign of exploitation.

ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

Do: Upgrade each deployed branch to the patched release outside the listed ranges (i.e., later than 9.18.50 / 9.20.27 / 9.21.25 or the corresponding -S1 builds) as published in ISC's advisory. Until patched, verify your version with 'named -v', ensure the resolver is not open to the internet by restricting recursion to trusted clients, monitor named CPU utilization for anomalies, and flush the cache if a suspicious SVCB/HTTPS AliasMode tree is suspected.