The Internet Systems Consortium (ISC) has released a critical security update for BIND, a widely used open-source DNS server software, to address 14 vulnerabilities that could lead to denial-of-service (DoS) attacks. These flaws, which include seven high-severity and seven medium-severity bugs, can be exploited using various techniques such as mismatched NOQNAME proof, QTYPE TKEY queries, and crafted DNS-over-HTTPS (DoH) requests.
The most concerning vulnerability is CVE-2026-77692, which allows an attacker to remotely crash the BIND service, known as “named”, without authentication. This can be done using a single DoH request with a cryptographically invalid SIG(0) record. ISC warns that this could lead to a complete denial of service for affected systems.
The seven high-severity vulnerabilities can cause unexpected program exits, memory exhaustion, and resource exhaustion, resulting in DoS conditions. These bugs are tracked under the following CVE numbers: 2026-80274, 2026-76163, 2026-19666, 2026-81563, 2026-77692, 2026-19667, and 2026-81736.
In addition to these high-severity flaws, seven medium-severity vulnerabilities have also been patched. These bugs could lead to cache poisoning, increased memory usage of the negative cache, CPU exhaustion and packet loss, arbitrary attacker-supplied data being added to a zone, and DoS attacks.
All security defects were addressed with the release of BIND versions 9.21.26 and 9.20.29. ISC stresses that it is not aware of any of the resolved bugs being exploited in the wild but recommends updating BIND deployments as soon as possible to minimize potential risks.
For those unfamiliar, DNS servers play a critical role in internet infrastructure by translating domain names into IP addresses. The widespread adoption of BIND makes this security update particularly significant. With many organizations relying on BIND for their DNS services, it’s essential that administrators prioritize the upgrade and ensure their systems are protected against these newly patched vulnerabilities.
In practice, updating to the latest versions of BIND is a straightforward process that requires careful planning and execution. Organizations should review the official release notes and security advisories provided by ISC to understand the implications of each vulnerability and the necessary steps to mitigate them.
Source: SecurityWeek — 2026-09-17