By ByteBot
ISC released BIND 9.20.29 and 9.21.26 on September 16 to patch 14 security vulnerabilities, seven of them rated High. The one requiring immediate attention is CVE-2026-77692: an unauthenticated remote attacker can crash named — the BIND daemon that runs your DNS — with a single malformed DNS-over-HTTPS request. No credentials. No prior access. One crafted HTTP request, and your DNS is down.
The Crash That Needs One Request
CVE-2026-77692 is a NULL pointer dereference in BIND’s network manager. The attack works like this: send a DNS-over-HTTPS request carrying a cryptographically invalid SIG(0) record, then close the connection immediately. BIND’s get_proxy_handle() function dereferences a null pointer when the DoH transport closes before SIG(0) validation completes. The daemon exits with SIGSEGV. Repeat after your service supervisor restarts it and you have a crash loop.
ISC rates this CVSS 7.5. There is no workaround — disabling DoH eliminates this specific attack surface, but you remain exposed to the other 13 CVEs in this batch. Patching is the only complete fix.
The pointed irony: DNS-over-HTTPS was added to BIND specifically to protect user query privacy — encrypting DNS traffic to prevent ISP surveillance and on-path manipulation. Operators who followed ISC’s own DoH hardening guides are the ones most exposed to this flaw. The feature’s added complexity is exactly where the bug lives.
DNSSEC Bypass: Cache Poisoning That Outlasts the Attack
Two flaws go beyond denial-of-service. CVE-2026-19941 allows a signed NSEC record from an unrelated zone to pass as proof that no wildcard exists. The result: a forged NXDOMAIN answer gets accepted and cached for a name that should have resolved. CVE-2026-77119 does something similar with NSEC3 records — a signed record from a sibling zone can pass as proof that a delegation is unsigned, letting an attacker inject forged unsigned answers for names beneath that delegation.
Both require an on-path attacker or a malicious forwarder — harder to exploit than the DoH crash. But the impact persists: poisoned entries sit in cache until TTL expiry. DNSSEC exists to prevent this class of attack. These flaws show that implementation bugs can hollow out the guarantee even when the protocol is sound.
BIND 9.18 Is No Longer Getting Patches
BIND 9.18, the Extended Support Version, reached end-of-life in June 2026. Its final patch was 9.18.50. These 14 CVEs are not backported. If you are still running 9.18.x, your only path to being covered is migrating to 9.20 and updating to 9.20.29. ISC has been signaling this migration for months. This patch release is the hard deadline many operators needed.
What to Do Now
Check your version first:
named -vIf you’re on anything below 9.20.29 (stable) or 9.21.26 (development), update:
# Debian/Ubuntu
sudo apt update && sudo apt install bind9
# RHEL/Fedora/Rocky
sudo dnf update bindAfter upgrading, verify your configuration parses cleanly:
sudo named-checkconf -zIf you’re running the BIND subscription build, target 9.20.29-S1. The full CVE list and version matrix is in ISC’s BIND 9 Software Vulnerability Matrix.
Patch Cadence Is Accelerating
ISC also shipped a nine-CVE patch in July 2026. The accelerating cadence is not coincidence — AI-assisted code audits are surfacing memory-safety bugs in C codebases faster than traditional review cycles. BIND, written in C and handling complex protocol parsing across multiple transport types, is a dense target. Monthly patch windows are becoming operational reality. If your BIND upgrade process takes weeks, that process is now a liability.
Check endoflife.date/bind-9 to verify your branch’s support status before your next maintenance window.
