Internet Systems Consortium released BIND 9 updates to fix 14 security flaws that could let attackers crash or exhaust the resources of widely used DNS servers. The fixes are in BIND 9.21.26 and 9.20.29 and cover seven high-severity issues including CVE-2026-80274, CVE-2026-76163, CVE-2026-19666, CVE-2026-81563, CVE-2026-77692, CVE-2026-19667, and CVE-2026-81736. ISC said CVE-2026-77692 can remotely abort the named process with a single crafted DNS-over-HTTPS request carrying an invalid SIG(0) record. ISC said it is not aware of in-the-wild exploitation.
Why it matters: BIND is core internet infrastructure, so denial-of-service flaws in it can knock domain-name resolution offline for organizations that run vulnerable servers. Admins using BIND should update to 9.21.26 or 9.20.29 promptly, especially if DNS-over-HTTPS or internet-facing resolvers are enabled.
Ionut Arghire
2026.09.17
100% relevant
This article establishes a distinct new patch-and-vulnerability event for ISC BIND 9, with specific fixed versions and CVEs, and does not match an existing tracked story.
info@thehackernews.com (The Hacker News)
2026.09.17
99% relevant
This article covers the same ISC BIND 9 security release fixing 14 flaws, including an unauthenticated crash issue affecting DNS-over-HTTPS, and serves as a report on that patch event.
← Back to all stories