The Internet Systems Consortium (ISC) has announced the release of BIND versions 9.20.29 and 9.21.26, aimed at addressing fourteen security vulnerabilities identified in its open-source DNS server software. These updates, disclosed on September 16, include a critical flaw affecting servers that respond to DNS-over-HTTPS (DoH) requests. This particular vulnerability allows an unauthenticated user to crash the server process by sending a request with an invalid SIG(0) signature if the connection is terminated prematurely.
Details of the Security Patches
The newly released versions of BIND provide comprehensive fixes for these vulnerabilities. Specifically, BIND 9.20.29, part of the current stable branch, resolves all identified issues, while BIND 9.21.26, in the development branch, addresses thirteen of the fourteen, as CVE-2026-19662 does not impact this version. Additionally, the Supported Preview Edition, 9.20.29-S1, also mitigates all fourteen vulnerabilities.
ISC’s release notes indicate that there are no workarounds available for these issues. Twelve out of the fourteen vulnerabilities also affect the earlier BIND 9.18 branch, with no further updates planned since support concluded in June. ISC had previously advised users of 9.18 to upgrade to 9.20 promptly, emphasizing the risk posed by unsupported versions potentially being vulnerable to new security threats.
Potential Threats and Attack Scenarios
Among the fourteen vulnerabilities, two can be exploited without the attacker possessing their own DNS server. These affect only the 9.20 and 9.21 branches. The most notable of these, CVE-2026-77692, can lead to a server crash through a DNS-over-HTTPS request with an invalid signature. Another, CVE-2026-76163, can crash the server when handling a TKEY query if the configuration lacks a global options block.
Several other vulnerabilities require a recursive resolver setup, which processes name lookups on behalf of clients. These include crashes from crafted responses and issues that lead to CPU or memory exhaustion. Additionally, ISC has rated seven of these vulnerabilities as High, with a CVSS 3.1 score of 7.5, while the rest are considered Medium risks.
Implications and Recommendations
The vulnerabilities also pose risks to DNS data integrity, such as allowing resolvers to accept incorrect DNSSEC proofs or unauthorized zone data. The updates to BIND 9 require enhanced security measures, such as enforcing TSIG signatures on all message transfers, a practice already common among modern DNS servers.
While ISC has not reported any active exploitation of these vulnerabilities, public tests illustrating their conditions have been released. These tests serve to verify the effectiveness of the fixes rather than as tools for exploitation. As part of ongoing security efforts, ISC has committed to monthly BIND maintenance releases to address emerging vulnerabilities, driven by reports from both researchers and automated systems.
This release marks the fifth significant security update for BIND this year, with ISC emphasizing the need for users to remain vigilant and consistently apply updates to mitigate potential risks in their network infrastructure.
