ISC patches 14 BIND 9 flaws, including remote crashes and DoS

Internet Systems Consortium has disclosed fourteen vulnerabilities in BIND 9 and released patched builds in the 9.20 and 9.21 lines.

The flaws affect recursive resolvers and authoritative servers in mixed ways. Several can crash named remotely or exhaust CPU and memory. Others weaken DNSSEC validation or let unauthenticated input change live state before checks complete.

Among the more severe issues, unauthenticated IXFR deltas could be applied to a live zone before TSIG verification (CVE-2026-19033). A single DoH SIG(0) request could crash named without authentication (CVE-2026-77692). The message parser retained every identical singleton RDATA, opening a wire-to-work amplification path (CVE-2026-75029). Cached SVCB and HTTPS AliasMode trees could drive a remote CPU denial of service (CVE-2026-81736).

Recursive resolvers face multiple memory-safety and assertion problems. Two use-after-free bugs hit NOQNAME proof handling, including a DNS64 path (CVE-2026-19662, CVE-2026-19666). A validating resolver could abort while caching a mismatched NOQNAME proof (CVE-2026-80274). A 16-bit length truncation in negative-cache handling triggered a remote assertion failure (CVE-2026-19667). Excessive DNSSEC cryptographic material matching could exhaust resources (CVE-2026-19668).

DNSSEC and zone logic had further gaps: checkwildcard() could accept an out-of-zone NSEC as proof of wildcard nonexistence (CVE-2026-19941); NSEC3 insecure-referral proofs could draw on unrelated cached NSEC3 RRsets (CVE-2026-77119); out-of-zone database nodes could become authoritative zone cuts (CVE-2026-78301). An SVCB AliasMode additional-data error leaked qpcache references (CVE-2026-81563). A TKEY query could abort named when the configuration lacked a global options statement (CVE-2026-76163).

Nicki Křížek of ISC announced the set on oss-security and pointed operators to the fixed 9.20.29 and 9.21.26 releases. Sites running affected BIND 9 builds should upgrade; recursive and DNSSEC-validating deployments are especially exposed to the crash and resource-exhaustion class of bugs.