Affected Systems
ISC BIND 9 DNS server software. Critical DoH crash affects 9.20.0–9.20.27 and 9.21.0–9.21.25. Other flaws affect 9.11.0–9.18.50 (EOL), 9.20.0–9.20.27, and 9.21.0–9.21.25. Fixed in 9.20.29 and 9.21.26. Branch 9.18 reached end-of-life in June 2026 and receives no patch.
Exploitation Status
No active exploitation reported by ISC as of September 16, 2026. No public PoC available at time of advisory. Exploitation is straightforward for CVE-2026-77692 (DoH crash) and CVE-2026-76163 (TKEY crash), requiring only a single malformed request with no authentication.
Business Impact
Organizations running BIND 9 DNS servers face denial-of-service risk from unauthenticated attackers. The DoH crash (CVE-2026-77692, CVSS 7.5) allows a single malformed request to crash the named process on any BIND server with DNS-over-HTTPS enabled. Six additional High-severity flaws (CVSS 7.5) enable resolver crashes or resource exhaustion. Four Medium-severity flaws (CVSS 5.3–6.5) permit cache poisoning and unauthorized zone data serving under specific conditions. BIND 9.18 users on EOL branch remain unpatched and should migrate to 9.20. Linux distributions may lag in patching (Debian 12 not updated as of September 17, 06:20 UTC).
Urgency
🔴 Immediate
Recommended Actions
- Upgrade BIND 9.20 installations to 9.20.29 and BIND 9.21 to 9.21.26 immediately, prioritizing internet-facing and DoH-enabled servers.
- Identify BIND servers with DNS-over-HTTPS enabled and patch CVE-2026-77692 as highest priority; verify named.conf for DoH listeners (https block in listen-on).
- Migrate BIND 9.18 (EOL June 2026) and older branches to 9.20.29; coordinate with OS package maintainers if using distribution-provided BIND packages.
- Monitor named process for unexpected crashes or restarts; review logs for TKEY queries, SIG(0) signature errors, or abnormal resolver behavior.
- If immediate patching is not feasible, consider temporarily disabling DoH on BIND servers and restricting recursive resolver access to trusted networks only.