ISC Patches 14 Vulnerabilities in BIND 9 Security Updatec

The Internet Systems Consortium (ISC) has released new security updates for BIND 9, addressing 14 vulnerabilities that could expose DNS servers to denial-of-service (DoS) attacks and other security issues.

The flaws affect widely deployed versions of the open-source DNS server software. ISC has classified seven of the vulnerabilities as high severity, with potential consequences including memory exhaustion, excessive resource consumption, unexpected application termination and crashes of the named DNS service.

Seven High-Severity Vulnerabilities Addressed

The high-severity vulnerabilities are tracked as:

• CVE-2026-80274
• CVE-2026-76163
• CVE-2026-19666
• CVE-2026-81563
• CVE-2026-77692
• CVE-2026-19667
• CVE-2026-81736

According to ISC, the vulnerabilities can be triggered through various specially crafted DNS requests and responses. Attack scenarios involve mismatched NOQNAME proofs, QTYPE TKEY queries, malformed authoritative-server responses, SVCB and HTTPS AliasMode records, crafted DNS-over-HTTPS (DoH) requests and unusually large negative DNS responses.

DoH Flaw Can Crash BIND Remotely

One of the vulnerabilities, CVE-2026-77692, is particularly notable because it can reportedly be exploited remotely without authentication.

ISC said an attacker could cause the named process to terminate by sending a specially crafted DNS-over-HTTPS request containing an invalid SIG(0) record and prematurely closing the connection.

Successful exploitation could disrupt DNS services and potentially affect systems and applications that depend on the affected server for name resolution.

Seven Medium-Severity Bugs Also Fixed

The security update also addresses seven vulnerabilities rated medium severity.

These flaws can potentially result in several types of security and availability problems, including DNS cache poisoning, increased memory consumption in the negative cache, excessive CPU usage and packet loss.

Other issues could allow attacker-controlled data to be introduced into a DNS zone or contribute to denial-of-service conditions.

BIND 9.21.26 and 9.20.29 Released

ISC has fixed the reported security issues in BIND 9.21.26 and BIND 9.20.29.

Organizations running affected BIND 9 deployments should review the security advisories and upgrade to a fixed version as part of their vulnerability-management process.

ISC said it is not currently aware of exploitation of these vulnerabilities in the wild. Nevertheless, administrators are encouraged to apply the available updates promptly, particularly on DNS infrastructure exposed to untrusted networks.

DNS Administrators Urged to Review Deployments

DNS servers are fundamental to internet and enterprise infrastructure, making vulnerabilities in widely used DNS software potentially disruptive even when they do not provide direct code execution.

Administrators should identify BIND installations in their environments, determine whether vulnerable versions are deployed and prioritize updates according to their organization’s risk and exposure.

ISC has published additional technical details through its BIND security advisories and release documentation.