DNS Security

BIND 9.20.29: Unauthenticated DoH Crash of named

Published September 19, 2026 · DNS Benchmark Pro Editorial · Reading time: 6 minutes

Yesterday’s Unbound validator advisory was about a recursor digesting a hostile DNSKEY. This DNS security follow-up is about the other dominant open-source engine. BIND still answers a large share of authoritative zones and a long tail of enterprise caches. When the process that speaks DNS over HTTPS can be knocked over by a single unauthenticated request, the outage is the incident — even if nobody gets a shell. That is why this week’s cybersecurity news belongs on the resolver board, not next month’s change window.

What CVE-2026-77692 actually breaks

ISC’s advisory is short and specific. An attacker sends a crafted DoH request that includes a cryptographically invalid SIG(0) record, then closes the transport before named finishes checking the signature. The daemon aborts. Impact is availability only: CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No privileges. No click. The only precondition is that the instance answers DoH.

That precondition is no longer exotic. Operators turned on DoH so stub resolvers and browsers could skip plaintext 53/udp. The same listener is now a remotely reachable crash gadget on 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25, plus the matching Supported Preview builds through 9.20.27-S1. Fixed trains are 9.20.29, 9.21.26 and 9.20.29-S1. ISC credits Vitaly Simonovich for the report. Public disclosure landed on 16 September after an early-notification pass that began on 9 September.

The rest of the fourteen

Seven of the fourteen are High. Most of the High set needs the attacker to run a name server the victim will follow, which is the ordinary recursor threat model: a look-up for an unseen name is enough to put hostile bytes on the wire. Two more High bugs live in SVCB/HTTPS AliasMode handling — CVE-2026-81563 lets the cache grow past its limit until resolution fails; CVE-2026-81736 burns CPU on a cached alias tree. Both are a quiet DDoS attack against the recursor itself, not against an origin.

Integrity bugs sit under the High line and still matter for DNS security. CVE-2026-19941 is the one operators should not skip because the score is 5.9: a validating resolver can accept a forged NXDOMAIN when the attacker controls a signed zone at the same or an upstream level, on-path or as a forwarder. CVE-2026-77119 downgrades a secure delegation so a forged unsigned answer is accepted. CVE-2026-19033 applies unauthenticated IXFR deltas to a live zone before TSIG verification. CVE-2026-78301 can serve out-of-zone data as authoritative and poison cache if the same process also recurses.

ISC published no workarounds for any of the fourteen. Each advisory states the project is not aware of active exploits. That is a status as of 16 September, not a reason to wait. The 9.20.29 source tree also adds system tests for at least six of the bugs, including one that sends the invalid SIG(0) DoH request, closes the connection, and checks that named survives.

Why a named crash is a network outage

A crashed recursor does not page like a firewall. Stubs retry, operating systems rotate to the next configured forwarder, and users report “the internet is slow.” That is how a DNS security defect becomes a network outage without a single red banner on the vendor console. If the next forwarder is a public resolver you never intended to use, you have also changed who sees the query stream. Measuring DNS server performance and network latency from the affected LAN is the cheap way to see that failover happen.

BIND 9.18 makes the calendar worse. Support ended in June 2026. Twelve of the fourteen flaws reach 9.18.50. ISC’s matrix now marks the branch EOL and says EOL versions should be assumed vulnerable to new CVEs. There will not be a 9.18.51 that closes the DoH crash, because that crash never existed on 9.18 — but the resolver-side High bugs did. Remaining 9.18 authoritative boxes and caches are tech infrastructure running past the vendor’s patch promise.

What operators should do this week

1. Inventory the binary, not the package nickname. named -v on every host that answers 53/tcp, 53/udp, 853 or 443/DoH. Distro packages often lag the ISC tag. You want 9.20.29, 9.21.26 or 9.20.29-S1.
2. Treat DoH listeners as internet-facing. If listen-on or http endpoints are reachable from untrusted networks, CVE-2026-77692 is a one-packet outage. Restrict the listener or patch before the next scan cycle.
3. Do not run 9.18 as a plan. Move remaining 9.18 authoritative and recursive instances onto 9.20.29. There is no ISC fix train left on that branch.
4. Confirm a global options block exists. CVE-2026-76163 is a configuration foot-gun as much as a parser bug. A missing options { } is enough.
5. Watch for crash-loops, not just CVEs. A recursor that restarts every few minutes after a burst of DoH clients is the exploitation pattern even if nobody has published a PoC.
6. Re-baseline what clients resolve. A network diagnostic tool run from the network BIND serves will show whether answers still arrive, whether latency shifted, and whether a silent failover landed on a different public resolver. See how the benchmark validates responses and the DNS over HTTPS primer if you need to distinguish plaintext 53 from the encrypted listener you just patched.

Industry impact: encrypted DNS did not shrink the attack surface

DoH was sold as a privacy control. It is also a new parser sitting in front of the same C daemon that already had to digest SIG(0), TKEY, SVCB and DNSSEC proofs. That is why validator and transport bugs keep generating DNS security advisories in the same week across Unbound and BIND, and why “we enabled DoH, so we are fine” is not an incident-response plan. The organisations that come through this cleanly will be the ones that can patch a recursor in hours, that log named exits, and that can prove from a network diagnostic tool what their clients actually query after the change.

Sources

• ISC Knowledge Base — CVE-2026-77692: Unauthenticated remote crash of named via a single DoH SIG(0) request (16 September 2026)
• ISC Knowledge Base — List of BIND Security Advisories
• ISC Knowledge Base — BIND 9 Software Vulnerability Matrix
• The Hacker News — BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS (17 September 2026)
• SecurityWeek — ISC Patches 14 Vulnerabilities in BIND 9 Security Update (17 September 2026)

This article is independent editorial analysis published by DNS Benchmark Pro / Genext Information Systems and is not affiliated with or endorsed by Internet Systems Consortium, The Hacker News or SecurityWeek. BIND is a trademark of Internet Systems Consortium.