BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks
ISC released BIND 9.20.29 patching 14 flaws, including two DNSSEC validation bypasses enabling cache poisoning and multiple denial-of-service bugs.
Internet Systems Consortium shipped BIND 9.20.29 (and 9.21.26) fixing 14 vulnerabilities affecting recursive and DNSSEC-validating resolvers. Key flaws include CVE-2026-77119 (CVSS 5.9), which lets injected NSEC3 records from sibling zones make forged answers appear validated, and CVE-2026-19941, enabling forged DNSSEC-validated NXDOMAIN responses. DoS issues include CVE-2026-19668 (CVSS 5.3, CPU exhaustion via crafted DS/DNSKEY key tags) and cache bloat bugs CVE-2026-81736 and CVE-2026-81563; CVE-2026-1903 fixes partially unsigned TSIG zone transfers and CVE-2026-78301 fixes out-of-zone record serving. ISC reports no active exploitation and says CVE-2026-19668 and CVE-2026-77119 have no workarounds, so upgrading is the only reliable mitigation.
- 14 vulnerabilities fixed across BIND 9.20.29 and 9.21.26 branches
- Two DNSSEC validation bypasses could enable cache poisoning and forged NXDOMAIN
- Several denial-of-service flaws exhaust CPU or memory on recursive resolvers
- No workarounds for CVE-2026-19668 and CVE-2026-77119; patching required
- ISC states it is not aware of active exploitation
- CVEs
- CVE-2026-77119CVE-2026-19941CVE-2026-19668CVE-2026-81736CVE-2026-81563CVE-2026-1903CVE-2026-78301
- Vendors
- Internet Systems Consortium
- Products
- BIND
- Organizations
- Internet Systems Consortium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-1903 | The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute of the 'sb_ravelry_designs' shortcode… | 6.4 | <1% | ||
CVE-2026-81736+3 related CVEs | Algorithmic CPU-exhaustion DoS in ISC BIND 9 resolver via cached SVCB/HTTPS records | 7.5 group max | — | ||
CVE-2026-81563+1 related CVE | Memory-Leak Denial of Service in ISC BIND Resolvers via Crafted SVCB/HTTPS Records | 7.5 group max | — |
From the original article
3 min read at gbhackers.com
The Internet Systems Consortium (ISC) has released BIND 9. 20. 29, which addresses 14 security vulnerabilities.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.