Loading story…
ISC disclosed CVE-2026-5947, a remotely exploitable use-after-free flaw in the BIND 9 recursive resolver that can crash the named process during SIG(0) signature validation. The bug stems from a race condition between asynchronous signature verification and recursive query cancellation when the recursive-clients quota is exhausted, allowing a resquery_t object to be freed while callback code still dereferences it. ISC rated the issue CVSS 7.5 and said the demonstrated impact is denial of service, while arbitrary code execution is considered unlikely.
The vulnerability affects BIND 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1; the 9.18.x ESV branch is not affected because it does not use the asynchronous SIG(0) verification path. According to ISC, no authentication is required, and exploitation is possible if an attacker controls an authoritative server or forwarder that returns SIG(0)-signed responses under query-flood conditions. Fixes were released in 9.20.23, 9.21.22, and 9.20.23-S1, replacing the raw pointer handling with reference-counted attachment and corresponding detach logic.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Fixes for CVE-2026-5947 were released in BIND 9.20.23, 9.21.22, and 9.20.23-S1. The remediation replaced a raw resquery_t pointer with a reference-counted attachment and added matching detach calls.
ISC publicly disclosed CVE-2026-5947, a remotely exploitable denial-of-service flaw in BIND 9 caused by a SIG(0) validation race condition leading to a use-after-free in named. The disclosure rated the issue CVSS 7.5 and noted that arbitrary code execution was considered unlikely.
An ISC GitLab issue documented a heap use-after-free in BIND's recursive resolver caused by a race between asynchronous SIG(0) verification and recursive query cancellation under recursive-clients exhaustion. The issue described remote denial-of-service impact and proposed a fix using reference-counted resquery attachments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcegitlab.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026
ISC disclosed **CVE-2025-40777**, a high-severity denial-of-service flaw in BIND 9 that can cause `named` to exit during recursive lookups when the resolver is configured as a caching resolver with serve-stale enabled and `stale-answer-client-timeout 0`. The bug is triggered by a specific CNAME resolution path involving stale cache behavior and can be exploited remotely against affected resolvers; authoritative-only deployments are not believed to be impacted. ISC assigned the issue **CVSS 7.5** and **CWE-617**, said there was no known active exploitation, and identified affected releases as **BIND 9.20.0 through 9.20.10**, **9.21.0 through 9.21.9**, and Supported Preview Edition builds. Related BIND bug reports show the same configuration also caused stale RRsets in CNAME chains to be mishandled, with refresh queries missing or incomplete and logs incorrectly reporting stale-answer activity for records that were not yet stale. ISC said fixes and regression tests were prepared through its coordinated release process, with the vulnerability addressed in **9.20.11** and **9.21.10** and the stale-refresh bug later fixed in **9.20.12** and **9.21.11**. As a workaround, ISC advised operators to upgrade or disable the vulnerable stale-answer settings until patched versions are deployed.
Jul 10, 2026
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026