BIND 9 patch fixes 14 DNS server flaws, one DoH crash

The Internet Systems Consortium (ISC), the organisation that maintains BIND 9, has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws in the open-source DNS server software, all disclosed on 16 September. One of them affects any BIND 9 server that answers DNS-over-HTTPS (DoH), a way of carrying DNS lookups, the system that turns a domain name into the address of a server, inside ordinary encrypted web traffic. ISC says in its advisories that a sender with no credentials at all can crash the server process, named, with a single request carrying an invalid SIG(0) signature, provided that the sender closes the connection before named finishes checking that signature. ISC adds that it is not aware of any of the fourteen flaws being exploited.

Which update fixes what depends on which branch is running. BIND 9.20.29, on the current stable branch, fixes all fourteen. BIND 9.21.26, on the development branch, fixes thirteen, because CVE-2026-19662 does not affect 9.21. The Supported Preview Edition for support customers, 9.20.29-S1, fixes all fourteen, matching the -S1 ranges listed in ISC's advisories. ISC lists no workarounds for any of the fourteen, so applying the update is the only remedy it offers.

Older installations are in a harder position. Twelve of the fourteen affect the 9.18 branch, up to and including 9.18.50, its final release. ISC ended support for 9.18 at the end of June and lists no 9.18 release that fixes them. It said in May that 9.18 users should plan to move to 9.20 as soon as possible, and its vulnerability matrix states that end-of-life versions should be assumed to be vulnerable to new CVEs, the standard identifiers given to publicly catalogued security flaws. Operating system packages are a separate matter: Debian 12 ships a package based on 9.18.49, and its security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September.

Two of the fourteen can be triggered by a request alone, without the attacker running a DNS server of their own, and both affect only the 9.20 and 9.21 branches. The DoH crash is CVE-2026-77692. The second, CVE-2026-76163, lets a query of type TKEY, a record type used by name servers to negotiate keys between themselves, crash named when the server's configuration file, named.conf, has no global options block.

For most of the others, the attacker needs a recursive resolver, the kind of server that looks up names on behalf of clients, to receive crafted data from a server the attacker controls. A single crafted response can crash a resolver running a default configuration (CVE-2026-19667, a negative answer of exactly 65,536 bytes sent from an attacker-run server), a resolver using dns64 with break-dnssec yes (CVE-2026-19666, where the malformed answer is served from cache), or a validating resolver, one that checks the cryptographic signatures attached to DNS data, receiving a wildcard answer carrying both NSEC and NSEC3 proofs at the same name (CVE-2026-80274, which can also produce a SERVFAIL or a wrong denial record). A fourth, CVE-2026-19662, needs a particular order and timing of answers from an attacker-run signed zone and does not affect 9.21.

Four more of the fourteen use up a resolver's CPU or memory instead of crashing it. Two of them work through cached SVCB or HTTPS alias records: with CVE-2026-81563 the cache grows past its limit until resolution fails, after a resolver repeatedly follows an SVCB or HTTPS alias with more than thirteen target records, and with CVE-2026-81736 a cached alias tree can exhaust the processor when clients are allowed recursion and the attacker runs a zone. CVE-2026-19668 exhausts the CPU of a validating resolver through a zone with many key tags and no valid match, and ISC notes that default record limits reduce exposure. CVE-2026-75029 pushes memory use beyond configured limits when a response repeats the same SOA, CNAME or DNAME record many times. ISC rates seven of the fourteen High, all at 7.5 on CVSS 3.1, a standard severity scale where 10 is the worst: the crashes described above except CVE-2026-19662, plus the two SVCB and HTTPS flaws. The other seven are Medium, from 5.3 to 6.5.

The remaining four flaws concern the integrity of DNS data, what a server hands out or what a resolver accepts, rather than crashes or exhaustion. ISC rates all four Medium, and each comes with conditions on where the attacker sits or what they already control.

Two of them let a validating resolver accept the wrong DNSSEC proof. With CVE-2026-19941, a signed NSEC record from an unrelated zone can pass as proof that no wildcard exists. An attacker sitting on the network path, or a malicious forwarder, that controls a signed zone could use that to get a forged NXDOMAIN answer accepted for a name that should resolve through a wildcard, and the forged answer would pass DNSSEC validation. With CVE-2026-77119, a signed NSEC3 record from an unrelated sibling zone can pass as proof that a delegation is unsigned, and an attacker able to inject responses to the resolver's queries could then get a forged unsigned answer accepted for names beneath that delegation. ISC describes both outcomes as cache poisoning, meaning false data kept and reused by a resolver.

CVE-2026-19033 concerns a secondary server, one that copies a zone of DNS records from a primary server and accepts only transfers signed with a TSIG key, a shared secret used to authenticate such transfers. During a multi-message incremental transfer (IXFR) over TCP, named could begin serving the new zone data before the final message carrying the signature arrived, and it did not roll back if that signature never came. A party able to deliver such a transfer could get unauthorized zone contents served without holding the key. The fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice.

CVE-2026-78301 needs more access than the rest: an attacker who can get a malformed zone loaded onto an authoritative server, for example through a zone transfer. A zone containing an NS or DNAME node above its own origin is then treated as a zone cut, so queries for names inside the zone return an out-of-zone delegation instead of the zone's own data. If the server also recurses, it can follow that delegation and cache attacker-supplied records for names outside the zone, and the effect lasts as long as the malformed zone stays loaded.

Each of ISC's fourteen advisories, published on 16 September, says the organisation is not aware of any active exploits. None of the fourteen appears in CISA's Known Exploited Vulnerabilities catalog as of the catalog version released the same day. CISA is the United States Cybersecurity and Infrastructure Security Agency. Tests that reproduce the flaws are public, however. ISC said in May that it now releases reproduction tests when it publishes a vulnerability, and the 9.20.29 source tree adds system tests