DNS Security
BIND 9 DoH Crash: 14 DNS Security Flaws, Patch Now
By Nattapong Sukkasem · Published · Updated .
TL;DR — ISC shipped BIND 9.20.29 and 9.21.26 on 16 September 2026. Lead item CVE-2026-77692 is an unauthenticated DNS-over-HTTPS SIG(0) crash of named.
This DNS security follow-up is about the other dominant open-source engine after yesterday's Unbound advisory. When the process that speaks DNS over HTTPS can be knocked over by one unauthenticated request, the outage is the incident.
What CVE-2026-77692 actually breaks
An attacker sends a crafted DoH request with an invalid SIG(0) record, then closes the transport before named finishes checking the signature. The daemon aborts. CVSS 7.5 availability only. Fixed in 9.20.29 / 9.21.26.
| Identifier | Class | Impact |
|---|---|---|
| CVE-2026-77692 | Unauthenticated DoH SIG(0) | Aborts named. No workaround. |
| CVE-2026-76163 | TKEY query, missing options block | Aborts named. |
| CVE-2026-19667 | Crafted 65,536-byte negative answer | Resolver crash including 9.18-era code. |
Why a named crash is a network outage
Stubs retry, operating systems rotate forwarders, and users report that the internet is slow. Measuring the path after a recursor restart is how you see silent failover.
What operators should do this week
- Inventory with named -v. Want 9.20.29, 9.21.26 or 9.20.29-S1.
- Treat DoH listeners as internet-facing.
- Do not keep 9.18 as a plan.
- Confirm a global options block exists.
Sources
Related articles
- MikroTik RouterOS MikroTrick Flaws Exploited: Patch Now
- Android 17 Enables Encrypted ClientHello by Default
- Hijacked ccTLDs Minted Google TLS Certs
Independent editorial analysis published by DNS Benchmark Pro / Genext Information Systems.
DNS angle
Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.
Source: ISC KB CVE-2026-77692 ().
September advisory checklist
Each CVE links to its ISC advisory, published 16 September 2026. Scores are CVSS 3.1 base scores. The fixed 9.20 release is 9.20.29; 9.18 is end of life and has no listed fix for this batch. Distribution packages may carry backported fixes; check your distributor before relying on a version string.
| CVE | Component | CVSS | 9.18 | 9.20 fixed |
|---|---|---|---|---|
| CVE-2026-81736 | SVCB / HTTPS response construction | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-19667 | Negative cache length handling | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-19662 | qpcache NOQNAME lifetime | 5.9 | EOL; migrate | 9.20.29 |
| CVE-2026-19941 | Wildcard denial proof | 5.9 | EOL; migrate | 9.20.29 |
| CVE-2026-77692 | DoH SIG(0) handling | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-78301 | Zone database boundaries | 5.8 | EOL; migrate | 9.20.29 |
| CVE-2026-81563 | SVCB cache references | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-19666 | DNS64 proof handling | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-76163 | TKEY configuration handling | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-80274 | DNSSEC NOQNAME caching | 7.5 | EOL; migrate | 9.20.29 |
| CVE-2026-19033 | IXFR authentication ordering | 6.5 | EOL; migrate | 9.20.29 |
| CVE-2026-19668 | DNSSEC verification resources | 5.3 | EOL; migrate | 9.20.29 |
| CVE-2026-75029 | Repeated singleton records | 5.3 | EOL; migrate | 9.20.29 |
| CVE-2026-77119 | NSEC3 delegation proof | 5.9 | EOL; migrate | 9.20.29 |
Check exposure and upgrade safely
The DoH SIG(0) issue concerns a DoH listener. Other rows concern resolver validation, caching or authoritative service behaviour; disabling DoH does not address the whole batch. Record the role and configuration of every instance, including standby nodes and containers. Compare the installed package with your vendor's security tracker, then select a supported fixed package.
- Save the configuration and record the currently running binary and package versions.
- Validate the planned configuration with the tools provided by your package, and schedule a maintenance window with a tested fallback resolver.
- Upgrade a controlled instance first, restart it through your normal service manager, and confirm the running process uses the new binary.
- Test ordinary signed answers, negative answers and application lookups through the resolver. Check each enabled transport separately.
- Roll out to the remaining nodes and watch error rates, memory and restart counts. Keep the evidence with the change record.
Use the DNS lookup tool as a comparison point for public answers. It queries a public resolver and does not test your private BIND instance or prove that its binary is patched. A successful answer after a restart should be paired with a local version and package check.