"ISC is not aware of any active exploits," the Internet Systems Consortium wrote in its advisories on 16 September — even as it shipped fixes for fourteen separate security flaws in BIND 9, the widely used open-source DNS server.
Which releases fix the fourteen flaws
ISC published three fixes in its 16 September release notes. The releases and their coverage are:
- BIND 9.20.29 (current stable branch): fixes all fourteen issues.
- BIND 9.21.26 (development branch): fixes thirteen issues; CVE-2026-19662 does not affect 9.21.
- BIND 9.20.29-S1 (Supported Preview Edition for support customers): fixes all fourteen.
ISC lists no workarounds for any of the fourteen flaws. Twelve of the fourteen also affect the older 9.18 branch (up to and including 9.18.50, its final release), and ISC ended support for 9.18 at the end of June; ISC advised in May that 9.18 users should plan to update to 9.20 as soon as possible and that "EOL versions should be assumed to be vulnerable to new CVEs."
The DoH crash and other unauthenticated crashes (selected CVEs)
One of the most notable fixes addresses an unauthenticated crash in servers that answer DNS-over-HTTPS (DoH). CVE-2026-77692 allows a sender with no credentials to crash the server process named by sending a single DoH request with an invalid SIG(0) signature and closing the connection before named finishes checking the signature.
Two of the fourteen flaws can be triggered by a single request without the attacker needing to run their own DNS server; both affect only the 9.20 and 9.21 branches. The second such request-triggered crash is CVE-2026-76163, which lets a TKEY query crash named when the server's named.conf has no global options block.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResolver crashes, resource exhaustion, and data-integrity issues
Several other issues require an attacker-controlled authoritative server to deliver crafted responses to a recursive resolver. Examples include:
- CVE-2026-19667: a single crafted response can crash a resolver on a default configuration.
- CVE-2026-19666: a crafted response can crash a resolver using dns64 with break-dnssec yes.
- CVE-2026-80274: a validating resolver that receives a wildcard answer carrying both NSEC and NSEC3 proofs can be crashed by a single response.
- CVE-2026-19662: needs a particular order and timing of answers and does not affect 9.21.
Four vulnerabilities instead exhaust CPU or memory; two of those involve cached SVCB/HTTPS alias records (CVE-2026-81563 and CVE-2026-81736). ISC rates seven of the fourteen as High (all 7.5 on CVSS 3.1) — the crashes above except CVE-2026-19662, plus the two SVCB/HTTPS flaws — and the remaining seven Medium (scores from 5.3 to 6.5).
Four flaws affect DNS data integrity rather than crashes. Two allow a validating resolver to accept incorrect DNSSEC proofs: CVE-2026-19941 lets a signed NSEC from an unrelated zone pass as proof that no wildcard exists, and CVE-2026-77119 lets a signed NSEC3 from an unrelated sibling zone pass as proof that a delegation is unsigned — outcomes ISC describes as cache poisoning. CVE-2026-19033 concerns an IXFR over TCP where named could start serving new zone data before the final TSIG-signed message arrived, allowing unauthorized zone contents to be served; the fix requires a TSIG on every message of an incoming transfer. CVE-2026-78301 allows a malformed zone containing an NS or DNAME node above its origin to be treated as a zone cut, causing out-of-zone delegations to be served and, if the server also recurses, cached outside records.
Operational constraints: packages, tests, and disclosure status
Operating-system packaging complicates the update picture. Debian 12 ships a package based on 9.18.49, and Debian's security tracker had not listed any of the fourteen as of 06:20 UTC on 17 September. ISC emphasizes that operating-system packages are a separate matter from ISC releases.
ISC publishes reproduction tests alongside its advisories. The 9.20.29 source tree adds system tests for at least six of the fourteen issues, including a test that sends an invalid SIG(0) request over DoH, closes the connection, and checks that named survives; ISC said these tests confirm fixes rather than serve as attack tools, but they do spell out the trigger conditions.
Each of ISC's fourteen advisories, published on 16 September, states the project is "not aware of any active exploits." None of the fourteen appeared in CISA's Known Exploited Vulnerabilities catalog in the version released the same day.
What this means for technologists, operating-system maintainers, and researchers and attackers
- Technologists and security teams: prioritize upgrading to BIND 9.20.29 (or 9.20.29-S1 for support customers) where possible, since ISC lists no workarounds and several flaws are exploitable by unauthenticated requests or single crafted responses.
- Operating-system maintainers and enterprise packagers: review shipped BIND packages (for example, Debian 12's 9.18.49) and plan timely backports or updates; ISC has warned EOL branches should be assumed vulnerable and urged migration to 9.20.
- Researchers and attackers: ISC's release cadence and public reproduction tests make trigger details available; ISC told users to expect monthly maintenance releases for the remainder of 2026 after a flood of vulnerability reports from "large language models, by researchers and attackers alike."
ISC withdrew 9.20.28 during pre-release testing because it caused a regression, which is why these fixes arrive in 9.20.29 instead. Four of the fourteen defects were discovered in ISC's own testing; others were reported by named researchers including Vitaly Simonovich, Rintaro Kawasugi, Samy Medjahed (Ap4sh), Henrique Pereira, Owais Lone (thesecguy), a researcher credited as hythyt, and Zuyao Xu and Xiang Li of Nankai University.
For BIND operators, the choice is concrete: update to the fixed releases or accept that many 9.18-era installations — including some shipped in major distributions — remain exposed to a broad set of crash, exhaustion, and cache-poisoning conditions. ISC's notice that it is unaware of active exploitation is welcome, but the presence of public reproduction tests and multiple unauthenticated triggers means patches are best treated as urgent maintenance rather than routine upgrades.
