The Internet Systems Consortium (ISC) has recently issued new security updates for BIND 9, a prominent open-source DNS server software. This update addresses 14 vulnerabilities, with seven marked as high severity, which could potentially lead to denial-of-service (DoS) conditions.
High-Severity Vulnerabilities Identified
Among the 14 flaws, seven are notably severe, posing risks such as unexpected program termination, memory depletion, named termination, and resource exhaustion, all of which can result in DoS scenarios. These vulnerabilities can be remotely exploited.
The identified high-severity bugs are labeled as CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667, and CVE-2026-81736. They can be triggered through various means such as mismatched NOQNAME proof, QTYPE TKEY queries, malformed authoritative server responses, SVCB/HTTPS AliasMode records, crafted DNS-over-HTTPS (DoH) requests, and excessively large negative responses.
Noteworthy Remote Exploit
Particularly concerning is CVE-2026-77692, which can be exploited without authentication. A single crafted DoH SIG(0) request can cause the ‘named’ process to crash. ISC elaborates that an attacker could send a specially crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, then prematurely close the transport connection to trigger an abort.
Medium-Severity Flaws and Updates
The update also addresses seven medium-severity vulnerabilities. These issues could lead to cache poisoning, excessive memory usage in the negative cache, CPU exhaustion, packet loss, and arbitrary data insertion into a zone, as well as DoS attacks. All vulnerabilities have been fixed with the release of BIND versions 9.21.26 and 9.20.29.
While ISC has reported no known active exploitation of these vulnerabilities, it strongly advises users to update their BIND deployments promptly. Additional details can be found in the BIND security advisories and release notes.
For further context, similar security updates have been recently issued by other major tech companies, including Oracle and Apple, addressing hundreds of vulnerabilities.
