A single DoH request aborts BIND's named before the signature check finishes
ISC fixed fourteen flaws in BIND 9.20.29 and 9.21.26, with no workarounds for any of them. The unauthenticated crash is one of only two that never reached the end-of-life 9.18 branch.
The Watch · Security desk
What happened
- ISC disclosed fourteen security flaws in BIND 9 on 16 September and has released 9.20.29 on the stable branch and 9.21.26 on the development branch to fix them.
- CVE-2026-77692 lets an unauthenticated sender crash named with a single DNS-over-HTTPS request, and any BIND server that answers DoH is in scope.
- ISC rates seven of the fourteen High, every one of them at 7.5 on CVSS 3.1, and the remaining seven Medium, between 5.3 and 6.5.
- Twelve of the fourteen also affect the 9.18 branch through its final release, 9.18.50, and ISC ended support for that branch at the end of June without a fixed release.
Why it matters
- What it limits constraint ISC published no workaround for any of the fourteen, so a site terminating DoH on 9.20 or 9.21 has to upgrade. No configuration change prevents the crash.
- Who has to decide decision Operators still on 9.18 cannot patch out of the twelve flaws that reach it. The only path ISC offers is a move to 9.20, a branch upgrade rather than a point release, and that has been the advice since May.
- Who's exposed exposure The flaws that need nothing from the attacker are on the supported branches. The two a bare request can trigger are the two 9.18 does not have, so exposure to a stranger's single packet tracks DoH termination, not end-of-life status.
Next story · Security · 3h ago
Public exploit takes root on OpenBSD 7.9 through a bug that shipped as a reliability fixConfirmed2 publishers
named begins verifying a cryptographically invalid SIG(0) record on an incoming DNS-over-HTTPS request, the client closes the transport before that check finishes, and named aborts [3]. ISC wrote that "An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely" [5]. The sender needs no credentials and no DNS server of their own [3][19].
Twelve of the fourteen also affect 9.18, up to and including 9.18.50, the branch's final release [15]. Two do not, and they are exactly the two ISC says a bare request can trigger: CVE-2026-77692 and CVE-2026-76163, a TKEY query that crashes named when named.conf has no global options block [19][20][25]. The pre-authentication, single-packet exposure therefore sits on the branches that have a fix. Of the twelve still open on 9.18, the crashes need a recursive resolver to receive crafted data from a server the attacker controls [21]. The four data-integrity flaws each carry conditions on where the attacker sits or what they already control [11].
Seven of the fourteen are rated High, all at 7.5 on CVSS 3.1, and the other seven Medium, between 5.3 and 6.5 [7]. The High set is the crash flaws except CVE-2026-19662, plus the two SVCB/HTTPS alias-record exhaustion bugs [8][10]. So the DoH crash scores the same 7.5 as CVE-2026-19667, which needs a crafted response to reach a resolver on a default configuration [24]. ISC said in its advisories that it is not aware of any of the fourteen being exploited [6]. The development release, 9.21.26, fixes thirteen, because CVE-2026-19662 does not affect that branch; 9.20.29 and the 9.20.29-S1 preview edition fix all fourteen [13].
ISC told 9.18 users in May to plan an update to 9.20 as soon as possible [16], and its vulnerability matrix says "EOL versions should be assumed to be vulnerable to new CVEs" [17]. Distributions ship fixes on their own release schedule. Debian 12 ships a package based on 9.18.49, and the Debian security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September [18].
Two of the Medium flaws, CVE-2026-19941 and CVE-2026-77119, let a validating resolver accept the wrong DNSSEC proof, and ISC describes both outcomes as cache poisoning [9]. CVE-2026-19033 matters to anyone running secondaries that accept only TSIG-signed transfers. During a multi-message incremental transfer over TCP, named could start serving the new zone data before the final message carrying the signature arrived, and it did not roll back when that signature never came. A party able to deliver the transfer could get unauthorized zone contents served without holding the key [22]. The fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice [23].
What to watch
- Whether Debian and other distributions list the fourteen against their 9.18-based packages or ship backports.
- Public exploit code for CVE-2026-77692, which needs one request and no attacker-controlled zone.
- Any change to ISC's statement that it is not aware of exploitation of the seven High-rated flaws.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Internet Systems Consortium released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software.
- [2]
One of the fourteen flaws affects any BIND server that answers DNS-over-HTTPS (DoH).
- [3]
A sender with no credentials can crash the server process, named, with a single request carrying an invalid SIG(0) signature, if the sender closes the connection before named finishes checking the signature.
- [4]
The DoH crash is tracked as CVE-2026-77692.
- [5]
ISC: "An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely."
- [6]
ISC said in its advisories that it is not aware of any of the fourteen flaws being exploited.
- [7]
ISC rates seven of the fourteen High, all at 7.5 on CVSS 3.1, and the other seven Medium, from 5.3 to 6.5.
- [8]
The seven High-rated flaws are the crash flaws except CVE-2026-19662, plus the two SVCB/HTTPS flaws.
- [9]
CVE-2026-19941 and CVE-2026-77119 let a validating resolver accept the wrong DNSSEC proof, and ISC describes both outcomes as cache poisoning.
- [10]
Four of the fourteen use up a resolver's CPU or memory instead of crashing it, two of them through cached SVCB/HTTPS alias records (CVE-2026-81563 and CVE-2026-81736).
- [11]
The four flaws concerning the integrity of DNS data are all rated Medium, and each comes with conditions on where the attacker sits or what they already control.
- [12]
SecurityWeek reported that CVE-2026-77692 stands out because it can be exploited remotely without authentication to crash named with a single DoH SIG(0) request, and that ISC recommends updating BIND deployments as soon as possible.
- [13]
BIND 9.20.29 on the current stable branch fixes all fourteen; 9.21.26 on the development branch fixes thirteen, because CVE-2026-19662 does not affect 9.21; 9.20.29-S1, the Supported Preview Edition for support customers, fixes all fourteen.
- [14]
ISC lists no workarounds for any of the fourteen flaws.
- [15]
Twelve of the fourteen also affect the older 9.18 branch, up to and including 9.18.50, its final release; ISC ended support for 9.18 at the end of June and lists no 9.18 release that fixes them.
- [16]
ISC said in May that 9.18 users should plan to update to 9.20 as soon as possible.
- [17]
ISC's vulnerability matrix states that "EOL versions should be assumed to be vulnerable to new CVEs."
- [18]
Debian 12 ships a BIND package based on 9.18.49, and its security tracker had not listed any of the fourteen flaws as of 06:20 UTC on 17 September.
- [19]
Two of the fourteen can be triggered by a request alone, without the attacker needing a DNS server of their own, and both affect only the 9.20 and 9.21 branches.
- [20]
CVE-2026-76163 lets a query of type TKEY crash named when the server's named.conf has no global options block.
- [21]
The other crashes need a recursive resolver, the kind of server that looks up names on behalf of clients, to receive crafted data from a server the attacker controls.
- [22]
CVE-2026-19033: on a secondary server that accepts only transfers signed with a TSIG key, during a multi-message incremental transfer (IXFR) over TCP, named could start serving the new zone data before the final message carrying the signature arrived, and did not roll back if that signature never came, so a party able to deliver such a transfer could get unauthorized zone contents served without holding the key.
- [23]
The CVE-2026-19033 fix requires a TSIG on every message of an incoming transfer, and ISC says modern name servers already sign every message, so it expects no change in practice.
- [24]
A single crafted response can crash a resolver on a default configuration (CVE-2026-19667).
- [25]
The two flaws that do not affect 9.18 are the two that can be triggered by a request alone, CVE-2026-77692 and CVE-2026-76163.
Sources
2 independent publishers whose own reporting we read for this story.
- securityweek.comISC Patches 14 Vulnerabilities in BIND 9 Security Update
1 article · September 17, 2026
- thehackernews.comBIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS
2 articles · September 17, 2026
Topics and entities
Entities
- SecurityWeek
- Internet Systems Consortium
- The Hacker News
- Debian