BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS

Summary: The Internet Systems Consortium released BIND 9.20.29 and 9.21.26 on 16 September to fix fourteen flaws in its open-source DNS server software, including CVE-2026-77692, which lets an unauthenticated sender crash the named process over DNS-over-HTTPS with a single request carrying an invalid SIG(0) signature if the connection is closed before the signature check finishes. ISC rates seven of the fourteen High at 7.5 on CVSS 3.1, lists no workarounds, and notes that twelve also affect the end-of-life 9.18 branch, for which no fixing release exists.
Why it matters: Twelve of the fourteen flaws land on 9.18, which ISC stopped supporting at the end of June and which Debian 12 still ships a package based on - and ISC's own matrix says EOL versions should be assumed vulnerable to new CVEs. ISC also said the volume of fixes is driven by vulnerability reports generated by large language models, from researchers and attackers alike, and reproduction tests for at least six of these flaws are already public.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-19033 CVE-2026-19662 CVE-2026-19666 CVE-2026-19667 CVE-2026-19941 CVE-2026-76163 CVE-2026-77119 CVE-2026-77692 CVE-2026-80274 CVE-2026-81563 CVE-2026-81736
Related: ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026