BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks

The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute of the 'sb_ravelry_designs' shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

ISC's BIND 9 DNS server contains a resource-exhaustion flaw (CWE-407) in which a recursive resolver consumes excessive CPU and memory when it encounters large numbers of a particular kind of invalid DNSSEC record. A remote, unauthenticated attacker can trigger this by causing a BIND resolver to process attacker-influenced DNSSEC data — for example, by having the resolver look up names served from authoritative servers that return the malformed records — degrading or halting DNS resolution (availability impact only, per the CVSS vector). Any organization operating a BIND recursive resolver in the affected version ranges is exposed, including internet-facing open resolvers and internal enterprise, campus, and ISP resolvers; ISC notes that default settings of the 'max-records-per-type' and 'max-types-per-name' limits help mitigate the exposure. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; it was disclosed by ISC as one of fourteen BIND 9 vulnerabilities.

Do: Inventory all BIND 9 recursive resolvers (recursion enabled) and upgrade them to the first patched release in their branch per ISC's advisory for CVE-2026-19668 — i.e., versions newer than the affected ranges 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, and 9.20.9-S1–9.20.27-S1 (or the corresponding newer Subscription builds). Until patched, keep the default 'max-records-per-type' and 'max-types-per-name' limits in place (do not raise them) and restrict recursion to trusted client networks via allow-recursion ACLs, prioritizing resolvers that are internet-reachable or resolve external names.

This is a DNSSEC validation flaw (CWE-345) in BIND 9's `named` resolver, which may accept an inapplicable NSEC record as valid proof that no wildcard record exists for a zone name. An attacker positioned at the same or an upstream level of the victim's zone name — for example, an operator of a sibling or parent zone able to present the malformed NSEC proof — can trigger the flaw in a validating resolver. The result is that the victim's wildcard record is treated as nonexistent, so the attacker can spoof or suppress answers in a way that still passes DNSSEC validation, yielding a high integrity impact (no confidentiality or availability impact per the CVSS vector). Only operators running affected BIND 9 versions as validating resolvers, particularly zones that rely on wildcard records, are affected. The issue was disclosed by ISC as one of fourteen BIND 9 vulnerabilities; it is not in CISA's KEV catalog and no public proof-of-concept or known exploitation exists.

Do: Upgrade all validating `named` resolvers to the patched BIND 9 releases published by ISC for each affected branch (i.e., releases newer than 9.18.50, 9.20.27, 9.21.25 and the corresponding -S builds), per ISC's advisory for CVE-2026-19941. Administrators of DNSSEC-signed zones that depend on wildcard records should investigate client reports of unexpected NXDOMAIN/nodata answers. Restricting recursion to trusted clients is a useful defense-in-depth measure, but patching is the only complete fix.

BIND 9's DNSSEC validator can mistakenly accept a validly signed NSEC3 record from an unrelated sibling zone as proof that a delegation is insecure. An attacker who can inject a crafted response into a resolver's validation process (e.g., an on-path attacker or in a cache-poisoning race) can downgrade a securely signed delegation to insecure, causing a forged, unsigned answer to be accepted and cached. The impact is DNS spoofing of validating resolvers: integrity loss only, with no confidentiality or availability effect (CVSS 5.9, CWE-346 origin validation error). Any operator running an affected BIND 9 release with DNSSEC validation enabled is affected. No public proof of concept and no known in-the-wild exploitation have been reported.

Do: Upgrade validating resolvers to the patched BIND 9 release that fixes CVE-2026-77119 as soon as ISC publishes it (part of a 14-CVE BIND 9 disclosure; monitor ISC advisories for fixed build numbers). Until patched, restrict recursion to trusted clients and review which resolvers in your estate run affected versions with DNSSEC validation enabled. Not listed in CISA KEV and no PoC is public, but prioritize because successful abuse silently serves forged DNS records.

ISC BIND 9's named daemon incorrectly treats an NS or DNAME node placed above a zone's origin as a zone cut, so an attacker who can insert a malformed zone into an authoritative server (for example, via zone transfer or by loading zones on a shared DNS service) can make queries within that configured zone lose authoritative status and return an out-of-zone delegation. On servers that also provide recursion, BIND then follows this locally sourced, attacker-influenced cut and caches attacker-supplied data, poisoning answers for names outside the configured zone; the condition persists for as long as the malformed zone remains in the zone database. Any deployment running an affected BIND 9 version that combines authoritative service for attacker-influenceable zones with recursion, or that accepts zone transfers from less-trusted sources, is exposed. ISC assigned it CVSS 5.8 (medium) with high attack complexity and high privileges required, reflecting these preconditions. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.

Do: Upgrade each affected BIND 9 branch to the first ISC-patched release after the last affected version listed for that branch (including the -S1 subscription branches). Meanwhile, restrict AXFR/IXFR zone transfers to trusted peers with TSIG-signed allow-transfer ACLs, run authoritative and recursive service on separate named instances or disable recursion on authoritative-only servers, and audit zone files and transferred zones for NS or DNAME records at or above the zone origin, removing any malformed zone and flushing the cache if found.

A BIND recursive resolver that processes an SVCB or HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records fails to deallocate internal resources, leaking memory with each lookup (CWE-401). A remote, unauthenticated attacker can trigger this repeatedly, for example by pointing their own domains at crafted record chains that the resolver is asked to look up, until resource exhaustion prevents the resolver from performing any new recursive lookups. The impact is a high-severity denial of service against recursive DNS service; there is no confidentiality or integrity impact. All operators running affected BIND 9.18, 9.20, or 9.21 (including the -S1 Stable Preview editions) as resolvers are exposed, with internet-facing recursive resolvers at greatest risk. As of now there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade resolvers to the patched BIND release on your branch per ISC's CVE-2026-81563 advisory — i.e., any release newer than 9.18.50, 9.20.27, 9.21.25, 9.18.50-S1, or 9.20.27-S1 as applicable. Until patched, restrict recursion to trusted clients (allow-recursion ACLs) so internet hosts cannot drive lookups, and monitor resolver memory, restarting services that show abnormal growth. Treat unexplained loss of recursive resolution ability as a possible sign of exploitation.

ISC BIND 9 recursive resolvers spend disproportionate CPU time constructing a response when queried for the root of a tree of SVCB/HTTPS AliasMode records that they have already cached, creating an algorithmic-complexity denial-of-service condition (CWE-1050). An unauthenticated remote attacker can trigger it simply by sending such a query to a resolver holding a cached AliasMode tree, requiring no privileges or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The attacker's gain is denial of service: the named process wastes excessive CPU on crafted queries, degrading or halting DNS resolution for the clients that depend on that resolver. Only caching/recursive BIND 9 resolvers within the affected ranges of the 9.18, 9.20, 9.21 and supported -S1 subscription branches are affected; authoritative-only servers do not maintain this cache. No public proof-of-concept is known, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

Do: Upgrade each deployed branch to the patched release outside the listed ranges (i.e., later than 9.18.50 / 9.20.27 / 9.21.25 or the corresponding -S1 builds) as published in ISC's advisory. Until patched, verify your version with 'named -v', ensure the resolver is not open to the internet by restricting recursion to trusted clients, monitor named CPU utilization for anomalies, and flush the cache if a suspicious SVCB/HTTPS AliasMode tree is suspected.