Full Report
The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affects any BIND server that answers DNS-over-HTTPS (DoH). A sender with no credentials can crash the server process, named, with a single request that carries an invalid SIG
Analysis Summary
# Morning News Roll-up October 26, 2026
## Overview
Internet Systems Consortium (ISC) has released critical security updates for BIND 9 to address fourteen vulnerabilities, including a high-severity flaw that allows unauthenticated attackers to crash DNS-over-HTTPS (DoH) servers with a single request.
## Top Stories
### BIND 9 Update Fixes 14 Flaws, Including Unauthenticated DoH Crash
- Summary: ISC disclosed fourteen security flaws in BIND 9, seven of which are rated "High" severity. The most prominent, CVE-2026-77692, allows an unauthenticated remote attacker to crash a BIND server answering DoH requests by sending an invalid SIG(0) signature and closing the connection prematurely. Other flaws include cache poisoning risks and resource exhaustion.
- Source: hxxps://thehackernews[.]com/2026/09/bind-9-update-fixes-14-flaws-including[.]html
### Cache Poisoning and Logic Flaws in BIND 9 Validation
- Summary: Several medium-severity vulnerabilities (CVE-2026-19941 and CVE-2026-77119) were identified that could allow an attacker to bypass DNSSEC validation. By using unrelated NSEC/NSEC3 records, an attacker can trick a resolver into accepting forged NXDOMAIN responses or treating a delegation as unsigned, leading to cache poisoning.
- Source: hxxps://www[.]openwall[.]com/lists/oss-security/2026/09/16/4
### End-of-Life Warning for BIND 9.18 Users
- Summary: While twelve of the fourteen newly disclosed flaws affect the BIND 9.18 branch, ISC has officially ended support for this version. No official patches will be released for 9.18, and users are urged to migrate to the 9.20 stable branch immediately to remain protected against these and future exploits.
- Source: hxxps://kb[.]isc[.]org/docs/bind-9-end-of-life-dates
# Main Topic
Critical security updates for BIND 9 addressing fourteen vulnerabilities, including remote denial-of-service (DoS) and cache poisoning flaws.
## Key Points
- **Remote Crash Vulnerability:** A single, unauthenticated request carrying an invalid SIG(0) can crash the `named` process if the connection is closed before signature verification completes (CVE-2026-77692).
- **DNS-over-HTTPS Impact:** The most severe crash vulnerability specifically targets servers configured to answer DoH requests.
- **Complexity of Exploitation:** While some flaws require only a simple query, others (like resolver crashes) require the attacker to control a malicious DNS server or act as a man-in-the-middle.
- **Resource Exhaustion:** Two high-severity flaws (CVE-2026-81563 and CVE-2026-81736) allow attackers to exhaust a resolver's CPU or memory using cached SVCB/HTTPS alias records.
- **DNSSEC Bypasses:** Multiple flaws allow for cache poisoning by tricking validating resolvers into accepting incorrect NSEC/NSEC3 proofs.
## Threat Actors
- **Attribution:** No specific threat actors have been identified as exploiting these flaws in the wild yet.
- **Potential Actors:** Unauthenticated remote attackers and malicious DNS zone operators.
## TTPs
- **Denial of Service (DoS):** Triggering server crashes via malformed SIG(0) signatures or TKEY queries.
- **Cache Poisoning:** Injecting forged DNS responses by exploiting logic errors in DNSSEC validation sequences.
- **Resource Exhaustion:** Flooding resolvers with specific record types (SVCB/HTTPS) to consume system memory and CPU.
- **Connection Manipulation:** Prematurely closing TCP/HTTPS connections to trigger race conditions or unhandled exceptions in the signature verification process.
## Affected Systems
- **BIND 9.20.x:** Versions prior to 9.20.29.
- **BIND 9.21.x (Development):** Versions prior to 9.21.26.
- **BIND 9.18.x (End-of-Life):** All versions up to 9.18.50 are affected but will not receive official updates.
- **Operating Systems:** Distributions shipping BIND packages (e.g., Debian 12) are affected until maintainers backport the fixes.
## Mitigations
- **Immediate Update:** Upgrade to BIND **9.20.29** (Stable) or **9.21.26** (Development).
- **Migration:** Users on the EOL 9.18 branch must migrate to 9.20.x immediately.
- **Configuration Review:** Ensure `named.conf` has proper global options blocks to mitigate specific crash vectors like CVE-2026-76163.
- **TSIG Requirements:** Ensure TSIG is required on every message of an incoming zone transfer to mitigate CVE-2026-19033.
- **Workarounds:** ISC has stated there are no effective workarounds for these vulnerabilities other than patching.
## Conclusion
The disclosure of fourteen vulnerabilities in BIND 9 represents a significant risk to DNS infrastructure, particularly for organizations utilizing DNS-over-HTTPS. Because several of these flaws allow for unauthenticated remote crashes and cache poisoning, immediate patching is highly recommended. Organizations running the EOL 9.18 branch are at elevated risk and should prioritize migration to the 9.20 stable branch.