Loading story…
Internet Systems Consortium (ISC) released security updates for 14 vulnerabilities in BIND 9 and its Supported Preview Edition. Seven high-severity flaws can remotely crash named or exhaust resolver resources. Most notably, CVE-2026-77692 (CVSS 7.5) lets an unauthenticated attacker terminate named with a crafted DNS-over-HTTPS request carrying an invalid SIG(0) record and an early connection close. Other high-severity issues include assertion failures, use-after-free conditions, and memory exhaustion involving TKEY, DNS64, DNSSEC validation, negative caching, and SVCB/HTTPS processing.
Seven medium-severity vulnerabilities add risks of CPU and memory exhaustion, packet loss, and DNS integrity compromise. CVE-2026-19033 can apply unauthenticated IXFR data to a secondary zone before TSIG validation, while CVE-2026-78301, CVE-2026-77119, and CVE-2026-19941 can enable attacker-controlled referrals or cache poisoning under applicable conditions. Affected releases include BIND 9 lines through 9.18.50, 9.20.27, and 9.21.25; ISC fixed the issues in BIND 9.20.29 and 9.21.26 and advises administrators to deploy the applicable patched release promptly. ISC reported no known active exploitation or workarounds; organizations should prioritize internet-facing authoritative servers, recursive resolvers, and DoH-enabled deployments, including BIND packages on Debian systems identified by current Nessus checks.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-931 warning that multiple BIND 9 release lines were affected and advising administrators to review ISC's vulnerability matrix and apply applicable updates.
ISC publicly disclosed 14 BIND 9 flaws—seven high severity and seven medium severity—and released fixes in BIND 9.21.26 and 9.20.29. The issues include remotely exploitable denial-of-service flaws, cache-poisoning risks, and unauthorized insertion of zone data; ISC stated it knew of no active exploitation.
ISC revised the fixed-version information in the affected BIND 9 vulnerability advisories before their public disclosure.
ISC issued early notifications for multiple BIND 9 vulnerabilities later tracked as CVE-2026-77692, CVE-2026-19668, CVE-2026-80274, CVE-2026-19033, CVE-2026-19667, CVE-2026-19662, CVE-2026-19666, CVE-2026-78301, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, and CVE-2026-19941.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
31 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcethehackernews.com
Open sourceacn.gov.it
Open sourcemalware.news
Open sourcetenable.com
Open sourcetenable.com
Open sourcekb.isc.org
Open sourcekb.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed four vulnerabilities in **BIND 9** affecting supported releases and Supported Preview Edition builds, including `CVE-2026-1519`, `CVE-2026-3104`, `CVE-2026-3119`, and `CVE-2026-3591`. The flaws impact DNSSEC validation and proof generation, authenticated queries containing `TKEY` records, and `SIG(0)` handling. Reported consequences include excessive CPU consumption during insecure delegation validation, a memory leak while preparing DNSSEC proofs, unexpected termination of the `named` daemon, and a stack use-after-return condition that could allow an ACL bypass. Affected branches include **BIND 9.11, 9.18, 9.20, and 9.21** across specified version ranges, and ISC said the public disclosure ended the embargo period so prepared packages could be released. Patched versions were issued as **9.18.47**, **9.20.21**, and **9.21.20**, and the Canadian Centre for Cyber Security urged administrators to review ISC’s advisories and apply the required updates.
Jun 29, 2026