DEV Community

kozhevniko
kozhevniko

Posted on

Cache Poisoning and Zone Injection: The Integrity Risks in the September 2026 BIND Advisory

#dns #iscbind #vulnerability

Cache Poisoning and Zone Injection: The Integrity Risks in the September 2026 BIND Advisory

Most DNS advisories are read as availability problems. CERT-In note CIVN-2026-0467 is not only that: it explicitly lists spoofing, cache poisoning, and unauthorized addition of data to a DNS zone among the possible outcomes of the 14 ISC BIND CVEs it covers.

Vulnerability overview

Published 21 September 2026 with a HIGH severity rating, the note covers CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736.

Mechanism and exploitation conditions

CERT-In attributes the flaws to use-after-free, a numeric truncation error, excessive platform resource consumption within a loop, missing release of memory after its effective lifetime, a reachable assertion, acceptance of extraneous untrusted data with trusted data, null pointer dereference, origin validation error, asymmetric resource consumption (amplification), insufficient verification of data authenticity, and inefficient algorithmic complexity. Three of those classes sit directly on the integrity boundary. An origin validation error means the server can accept data whose origin was not properly established. Insufficient verification of data authenticity means a response can be treated as genuine without adequate proof. Acceptance of extraneous untrusted data with trusted data means attacker-supplied content can ride along with data the server already trusts.
Exploitation requires sending specially crafted DNS queries, DNS responses, DNSSEC-related records, zone-transfer data, TKEY requests, SVCB/HTTPS records, or DNS-over-HTTPS requests. For the integrity classes, the meaningful precondition is that the attacker can get a crafted response or record in front of a server that will act on it, which is exactly the condition cache poisoning depends on.

Impact

The consequence of a successful integrity attack is not an outage but a wrong answer. A poisoned cache entry persists for the record's TTL and silently redirects traffic for as long as it lives. Spoofed responses undermine the assurance that an answer came from the legitimate authority for a name. Unauthorized zone data insertion changes what an authoritative server publishes, which can redirect mail, web traffic, or service discovery for an entire domain. None of these produce an obvious alert on their own, which is what makes them more dangerous than a crash.
CERT-In does not claim active exploitation of any of the 14 CVEs and does not publish per-CVE attack prerequisites.

Affected products and scope

Affected releases are BIND 9.11.0 through 9.18.50, BIND 9.20.0 through 9.20.27, BIND 9.21.0 through 9.21.25, BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and BIND Supported Preview Edition 9.20.9-S1 through 9.20.27-S1. The advisory does not map individual CVEs to individual releases; confirm the fixed build per CVE against ISC's advisories.

Exposure context

A ZoomEye search for app="ISC BIND" returned 19,364,144 assets. That figure counts internet-reachable BIND-fingerprinted hosts. It does not identify which of them are recursive resolvers whose caches could be poisoned, which is the population that matters most for this class of risk.

Remediation and mitigations

Apply the vendor updates referenced by CERT-In. In parallel, harden the trust boundary: enable and verify DNSSEC validation where the deployment supports it, restrict recursion to known clients so an off-path attacker cannot easily reach the resolver, require TSIG and explicit peer authorization for zone transfers, and disable dynamic update unless it is genuinely needed. Add monitoring for unexpected changes in cached answers and for authoritative data that changes outside a change window, because integrity failures rarely announce themselves.

References

Top comments (0)